feat(ha-config-bootstrap): add peer count and cert pre-flight validation (task 2.3)

- Implement validate_peer_count() in startup_validation.c: -EINVAL for even N>1
- Implement validate_cert_files() with err_buf output: access() check, writes
  missing path into err_buf, returns -ENOENT
- Wire validate_peer_count() in main.c after peer list parse; fatal exit on fail
- Wire validate_cert_files() in main.c before SSL init; fatal exit on fail
- Fix ASAN leak: SSL_CTX_free in ha_fini() with NULL guard
- Fix double-free: null c->ha.ssl_ctx in cluster_fini() before ha_fini(),
  so iomgr_fini() retains sole SSL_CTX ownership (design per ha.h comment)
- All 96 tests pass; all 12 ha_startup tests GREEN

src/controller/cluster.c

@@ -1047,6 +1047,8 @@ void cluster_fini(cluster_t* c)
         c->ha.standby_endpoints = NULL;
     }
 
+    /* iomgr owns the SSL_CTX lifetime; null ha's copy so ha_fini doesn't double-free */
+    c->ha.ssl_ctx = NULL;
     /* Stop HA watchdog thread before tearing down other subsystems — P1-5 */
     ha_fini(&c->ha);