Add failure-domain-aware replication acknowledgements and write quorum

## Problem

Dragonfly accepts writes based on local master state. `WAIT` counts any replica that has
acknowledged all shard LSNs, without considering rack or availability-zone identity. Therefore,
`WAIT 1` may acknowledge only a same-rack replica and provides no DC-loss guarantee.

Cluster topology stores node ID, IP, port, and health, but no failure domain. Health detection,
promotion, and fencing are delegated to the external cluster manager.

This limitation is documented, but its multi-DC data-safety implications still deserve a dedicated
issue.

## Impact

During a network partition, an old master can continue accepting writes while another DC promotes
a replica. Without external fencing, this can cause acknowledged-write loss or split brain.

## References

https://github.com/dragonflydb/dragonfly/blob/980c70331d194d7133079917668fec269444c65c/src/server/main_service.cc#L1411-L1417

https://github.com/dragonflydb/dragonfly/blob/980c70331d194d7133079917668fec269444c65c/src/server/server_family.cc#L3687-L3768

https://github.com/dragonflydb/dragonfly/blob/980c70331d194d7133079917668fec269444c65c/src/server/cluster/cluster_defs.h#L95-L116

https://github.com/dragonflydb/dragonfly/blob/980c70331d194d7133079917668fec269444c65c/docs/cluster-mode.md#L615-L628

Start by reading the referenced WAIT and acknowledgement paths in src/server/main_service.cc and src/server/server_family.cc, then inspect topology definitions in src/server/cluster/cluster_defs.h and the cluster-mode documentation. The issue does not define acceptance criteria; completion would require an agreed design for failure-domain-aware topology and write-quorum semantics, including the multi-DC safety behavior.

Written by the indexing model from the issue text.