feat(watch): add Watch mechanism and route writes through Raft

[slow2342]

Summary

Add bidirectional streaming Watch gRPC service for key change notifications. Refactor KvService to route writes through Raft consensus. Remove BTreeMap from state machine — RocksDB is now the single source of truth.

Changes

• proto/watch.proto — AetherWatch service with WatchRequest/WatchResponse messages.
• src/watch/mod.rs — WatchManager with broadcast channel fan-out, key/range filtering.
• src/api/watch.rs — gRPC WatchService implementation with bidirectional streaming.
• src/api/kv.rs — KvService refactored to route Put/Delete/Txn through raft.client_write(). Added require_leader() check. Reads remain direct from storage.
• src/raft/state_machine.rs — Removed BTreeMap, all reads/writes go through RocksDB. Storage errors properly propagated in apply_request, build_snapshot, install_snapshot.
• src/storage/rocksdb.rs — Added clear_default_cf() for snapshot restore.
• src/main.rs — Wired WatchManager, WatchService, refactored KvService.

Testing

• cargo build passes
• cargo clippy -- -D warnings passes
• cargo fmt -- --check passes
• cargo test passes (10 existing storage tests)

Related issues

Refs #78