Add live PHP API contract tests

[ejones23]

Summary

• Add an opt-in Vitest contract suite for the live PHP dev server at localhost:2461.
• Cover a real create ballot -> add entries -> get candidates -> vote -> get votes API flow, plus common validation/error response contracts.
• Harden a few PHP endpoints exposed by the live contract run: missing optional input guards, maxVotes defaulting for MySQL, and deterministic entry ordering in get-votes.php.

Verification

• npm test
• npm run test:api-contract
• npm run build
• Live production UI smoke: created a default ballot; confirmed POST /api/new-ballot.php payload included maxVotes: 1; voted and viewed expected results.
• Live production UI smoke: created a 2-position ballot; confirmed payload included positions: 2 and maxVotes: 1; voted and viewed expected results.

Notes

• The current production UI sends maxVotes, so the PHP default-to-0 behavior is for omitted/empty direct API requests rather than the normal browser creation path.
• Production schema uses entries.entry_id as an auto-incrementing primary key, so ORDER BY entry_id ASC reflects candidate insertion order for the existing add-entries flow.