feat(ha-config-bootstrap): add peer count and cert pre-flight validation (task 2.3)

- Implement validate_peer_count() in startup_validation.c: -EINVAL for even N>1
- Implement validate_cert_files() with err_buf output: access() check, writes
  missing path into err_buf, returns -ENOENT
- Wire validate_peer_count() in main.c after peer list parse; fatal exit on fail
- Wire validate_cert_files() in main.c before SSL init; fatal exit on fail
- Fix ASAN leak: SSL_CTX_free in ha_fini() with NULL guard
- Fix double-free: null c->ha.ssl_ctx in cluster_fini() before ha_fini(),
  so iomgr_fini() retains sole SSL_CTX ownership (design per ha.h comment)
- All 96 tests pass; all 12 ha_startup tests GREEN

src/controller/ha.c

@@ -454,6 +454,12 @@ void ha_fini(ha_state_t *ha)
         return;
     ha_stop_watchdog(ha);  /* join watchdog thread before destroying mutex */
     pthread_mutex_destroy(&ha->lock);
+
+    /* Fix ASAN leak: free the SSL context if one was allocated */
+    if (ha->ssl_ctx) {
+        SSL_CTX_free((SSL_CTX *)ha->ssl_ctx);
+        ha->ssl_ctx = NULL;
+    }
 }
 
 /* ── Redirect helpers used by join.c ───────────────────────── */