feat: CP11B-3 safe ops — promotion hardening, preflight, manual promote

Six-task checkpoint hardening the promotion and failover paths:

T1: 4-gate candidate evaluation (heartbeat freshness, WAL lag, role,
    server liveness) with structured rejection reasons.
T2: Orphaned-primary re-evaluation on replica reconnect (B-06/B-08).
T3: Deferred timer safety — epoch validation prevents stale timers
    from firing on recreated/changed volumes (B-07).
T4: Rebuild addr cleanup on promotion (B-11), NVMe publication
    refresh on heartbeat, and preflight endpoint wiring.
T5: Manual promote API — POST /block/volume/{name}/promote with
    force flag, target server selection, and structured rejection
    response. Shared applyPromotionLocked/finalizePromotion helpers
    eliminate duplication between auto and manual paths.
T6: Read-only preflight endpoint (GET /block/volume/{name}/preflight)
    and blockapi client wrappers (Preflight, Promote).

BUG-T5-1: PromotionsTotal counter moved to finalizePromotion (shared
    by both auto and manual paths) to prevent metrics divergence.

24 files changed, ~6500 lines added. 42 new QA adversarial tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

weed/server/integration_block_test.go

@@ -645,13 +645,16 @@ func TestIntegration_DoubleFailover(t *testing.T) {
 	// Reconnect vs1 first so it becomes a replica (via recoverBlockVolumes).
 	ms.recoverBlockVolumes(vs1)
 
-	// Simulate heartbeat from vs1 that restores iSCSI addr and health score
-	// (in production this happens when the VS re-registers after reconnect).
+	// Simulate heartbeat from vs1 that restores iSCSI addr, health score,
+	// role, and heartbeat timestamp (in production this happens when the
+	// VS re-registers after reconnect and completes rebuild).
 	e1, _ = ms.blockRegistry.Lookup("pvc-double-1")
 	for i := range e1.Replicas {
 		if e1.Replicas[i].Server == vs1 {
 			e1.Replicas[i].ISCSIAddr = vs1 + ":3260"
 			e1.Replicas[i].HealthScore = 1.0
+			e1.Replicas[i].Role = blockvol.RoleToWire(blockvol.RoleReplica)
+			e1.Replicas[i].LastHeartbeat = time.Now()
 		}
 	}