server: deny join if cluster is full

It is not a hack. The add node request is handled by run loop, so it needs some strategy to send back the error generated.

For now, we wait until timeout, and cannot distinguish between proposal failure and join denial through this way.

Moreover, I would prefer that addNode entry in raft log could be applied successfully always, so `join` and `remove` could appear in raft log in pair.