Election start should enqueue jobs and be failure tolerant

[hugocorbucci]

The current election start process is very simple but handles failures very poorly.
The clock action should really just enqueue a bunch of jobs to be consumed by workers who can be fault tolerant on their own (enqueue back in case of failure).

Maintaining anonymity of votes here might be a bit tricky. Weirdly, we might need to send the email first and persist the data after or add some columns to ensure the token is usable.