feat: add poll start/end endpoints, poll.leading WS handler, and poll state persistence

Adds POST /:id/voting/start and POST /:id/voting/end endpoints that
broadcast poll lifecycle events and persist poll state to the sessions
table. The poll.leading WebSocket message is now handled server-side
(rebroadcast + DB persist) with self-healing for polls started before
the persistence columns existed.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/routes/sessions.js

@@ -327,6 +327,64 @@ router.post('/:id/close', authenticateToken, (req, res) => {
   }
 });
 
+// Start voting/polling for a session (broadcasts poll.start to subscribers)
+router.post('/:id/voting/start', authenticateToken, (req, res) => {
+  try {
+    const sessionId = parseInt(req.params.id);
+    const session = db.prepare('SELECT * FROM sessions WHERE id = ?').get(sessionId);
+
+    if (!session) {
+      return res.status(404).json({ error: 'Session not found' });
+    }
+
+    if (session.is_active === 0) {
+      return res.status(400).json({ error: 'Session is not active' });
+    }
+
+    db.prepare(
+      'UPDATE sessions SET poll_active = 1, poll_started_at = ?, poll_leading_game_id = NULL, poll_leading_label = NULL, poll_leading_votes = NULL WHERE id = ?'
+    ).run(new Date().toISOString(), sessionId);
+
+    const wsManager = getWebSocketManager();
+    if (wsManager) {
+      wsManager.broadcastEvent('poll.start', { sessionId }, sessionId);
+    }
+
+    res.json({ success: true });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// End voting/polling for a session (broadcasts voting.ended to subscribers)
+router.post('/:id/voting/end', authenticateToken, (req, res) => {
+  try {
+    const sessionId = parseInt(req.params.id);
+    const session = db.prepare('SELECT * FROM sessions WHERE id = ?').get(sessionId);
+
+    if (!session) {
+      return res.status(404).json({ error: 'Session not found' });
+    }
+
+    if (session.is_active === 0) {
+      return res.status(400).json({ error: 'Session is not active' });
+    }
+
+    db.prepare(
+      'UPDATE sessions SET poll_active = 0, poll_started_at = NULL WHERE id = ?'
+    ).run(sessionId);
+
+    const wsManager = getWebSocketManager();
+    if (wsManager) {
+      wsManager.broadcastEvent('voting.ended', { sessionId }, sessionId);
+    }
+
+    res.json({ success: true });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
 // Delete session (admin only)
 router.delete('/:id', authenticateToken, (req, res) => {
   try {