The main use case for this is when running a cluster that's got a mix of physical servers and virtual machines as cluster members. This is somewhat common for security reasons where you want a single unified control plane but don't want containers running directly on bare metal, so you create a few VMs that themselves run Incus and are joined into the cluster, then containers get scheduled within those VMs.

The problem with that setup is that those VMs may get elected to run the Incus database, allowing for the situation where both a VM and its host are both database voters. Losing that physical server would then take out a majority of the database voters and end up breaking the database.

We should introduce some kind of cluster role, like database-client which then prevents the affected cluster member from getting elected to voter or stand-by within the cowsql cluster.