Optional write quorum for strong durability

## Problem
Writes ACK immediately after local flush; replication is eventual-consistent. A writer crash before replication completes can lose committed data on the surviving readers.

## Proposed Solution
Add an optional write quorum mode where the flush path waits for N peers to confirm receipt before ACKing the write to the client. Configurable quorum size.

## Context
Listed in release notes as a future item.

## Effort
Large — major feature touching the ingest path, flush acknowledgment, and replication protocol.