`check_valid()` accepts empty candidate lists and `max_choices = 0`

[HellFelix]

check_valid() does not guard against an empty candidates list or max_choices = 0. Both cases pass validation and produce a vote round where no meaningful vote can be cast, with no error surfaced to anyone.

File: rustsystem-server/src/proof/ballot.rs:77-88

Fix: Add self.candidates.is_empty() and self.max_choices == 0 guards.

[HellFelix]

There is an equivalent guard on the frontend that enforces these same checks, but these are more meant as a convenience/UX nicety than a guard.

[HellFelix]

Fixed with 8e33e66. Merged to stage with #64