Repair Smart Polling API proof

[ahmed-elsayed-programmer]

What changed

• Reframed the repository as the backend API it currently implements and removed the broken frontend gitlink and unauthenticated WebSocket path.
• Replaced committed development settings with fail-closed environment configuration, explicit hosts/CORS, shorter JWT lifetimes, and a patched Django 5.2 LTS release.
• Added creator-only mutations/results, typed answer validation, poll/question/option scoping, conditional visibility checks, cycle prevention, and atomic nested creation.
• Added a Submission aggregate with database-enforced one-submission-per-user/poll and one-answer-per-question constraints.
• Added migration preflight checks and lossless rollback handling for legacy answers.
• Added backend CI, dependency auditing, migration checks, an evidence-accurate README, and 23 tests.

Why

The previous README described a full-stack, PostgreSQL, real-time application that the repository could not reproduce. The backend also accepted cross-poll questions/options, allowed non-owners to mutate polls, used unsafe default settings, and had no meaningful tests.

This repair makes the repository a credible Django/DRF proof asset without claiming frontend, production, scale, or performance evidence that is not present.

Developer impact

• Local startup now requires DJANGO_SECRET_KEY.
• Poll update/delete and results are creator-only.
• Respondents receive 409 Conflict after an existing submission.
• Legacy duplicate answers or cross-question selected options stop the migration with a clear error instead of being silently rewritten.
• The removed historical development key must remain permanently unused.

Validation

• pip check
• pip-audit -r backend/requirements.txt: no known vulnerabilities
• ASGI import smoke test
• python manage.py check
• python manage.py makemigrations --check --dry-run
• complete forward migration chain
• 23 tests on Python 3.12 and 3.13, including legacy-data migration and rollback cases
• git diff --check
• independent correctness/security and README/CI reviews: approved