Harden gRPC startup and the votekick tally map

- Refuse to start the gRPC accounts API on an empty token: the
  constant-time compare treats two empty slices as equal, so a blank
  token would let an unauthenticated request through. Mirror the guard
  the JSON-RPC endpoint already had.
- Sweep expired votekick/voteban tallies on each vote. A passed vote
  removed its own key, but a tally that never reached threshold lingered
  forever, so the map could be grown without bound. The now-redundant
  per-key TTL reset goes away.

src/grpc.rs

@@ -338,6 +338,12 @@ pub async fn run(engine: Shared, cfg: GrpcCfg, outbound: broadcast::Sender<LogEn
         Ok(a) => a,
         Err(e) => return tracing::error!(%e, bind = %cfg.bind, "bad grpc bind address"),
     };
+    // An empty token would make the constant-time compare pass for a request
+    // that sends no authorization header at all, exposing the account-authority
+    // API unauthenticated. Refuse to start rather than serve it open.
+    if cfg.token.is_empty() {
+        return tracing::error!("grpc token is empty; refusing to start an unauthenticated accounts API");
+    }
     let has_tls = cfg.tls.is_some();
     let accounts_svc = AccountsService { engine: engine.clone(), token: cfg.token.clone() };
     let stats_svc = StatsService { engine: engine.clone(), token: cfg.token.clone() };