fix: save failover votes and send them directly

[kacy]

Three problems with failover votes.

1. A primary kept the epoch of its last vote only in memory. If it restarted during an election, it could vote a second time in the same epoch.
2. Vote requests and grants rode on regular gossip and were relayed from node to node. A VoteGranted update named its voter in a from field that nothing checked, so any node that can send gossip could give a candidate a quorum by sending grants in the name of each primary. The cluster secret only proves the sender is some member of the cluster.
3. A VoteRequest with a huge epoch made every primary that granted it record that epoch as its last vote. None of them could vote in a real election afterwards.

The first commit moves the last vote epoch into ClusterState:

• It is saved in nodes.conf as lastVoteEpoch on the vars line.
• A primary saves it before granting the vote.
• Files without the field still load.
• The in-memory counter is gone.

The second commit sends votes directly:

• A new GossipMessage::Election carries one VoteRequest or VoteGranted. It is sent straight to the node it is for and never relayed.
• The receiver accepts it only when the named candidate or voter is the message's sender, and the UDP packet came from the gossip address it knows for that node. Vote updates that arrive piggybacked are ignored.
• The candidate sends its request to every voter in the round's voter set. The voter sends its grant straight back.
• A primary refuses a request more than MAX_VOTE_EPOCH_AHEAD (100) past its current epoch. Since fix: resolve conflicting slot claims by config epoch #412, nodes see each other's epochs in slot claims, so a real candidate is at most ELECTION_ROUNDS ahead.

This adds a gossip message type, so, as with #412, the nodes of a cluster need to be upgraded together. The automatic failover integration test passes with direct votes. New unit tests cover the address and sender checks, piggybacked votes, the epoch bound, and saving the vote epoch.