`check_valid()` accepts empty candidate lists and `max_choices = 0`

`check_valid()` does not guard against an empty `candidates` list or `max_choices = 0`. Both cases pass validation and produce a vote round where no meaningful vote can be cast, with no error surfaced to anyone.

**File:** `rustsystem-server/src/proof/ballot.rs:77-88`

**Fix:** Add `self.candidates.is_empty()` and `self.max_choices == 0` guards.