rebased for readability - #7

No backward compatibility needed - this feature hasn't shipped. Replaces
JSON as the sole format for the ```poll fenced Markdown block on both
sides:

- Frontend: parsePollDefinition (types.ts) now parses with the `yaml`
  package instead of JSON.parse; CreatePollDialog serializes with
  YAML.stringify instead of JSON.stringify, producing exactly the target
  block shape (id/question/type/options as a plain mapping, options as a
  block sequence).
- Backend: poll_definition.go's rawPollDefinition struct tags switch from
  `json:"..."` to `yaml:"..."`, and findPollDefinitionInContent unmarshals
  with gopkg.in/yaml.v3 (already a direct dependency) instead of
  encoding/json.

Everything the task asked to keep intact is untouched: the nested voting
route (/api/v1/memos/{memoUid}/polls/{pollUid}/votes) and
EnsurePollBinding's memo-authorization flow, the strict pollUIDPattern
UUID regex, and deletePollDataByMemoIDsTx's user/memo-cascade cleanup
(store/db/{sqlite,postgres,mysql}/user_delete.go - this is the actual name
of the cleanup function the task referred to as
deletePollVotesByVoterTx; it deletes both poll and poll_vote rows by
memo_id, not by voter, and was not touched by this change).

While preserving pollDefinitionHash's canonical/injective requirement,
switching formats surfaced a real pre-existing bug worth fixing here:
the hash wrote a bare NUL byte as a separator between options with no
length prefix, which is not actually injective - an option string that
itself contains a NUL byte reproduces that exact separator byte sequence,
so e.g. options ["ab", "c"] and a single option "ab\x00c" hashed
identically. YAML permits arbitrary control characters in a quoted
scalar, so this was reachable from memo content, not just internal data,
and a collision here would let an edited option set silently keep votes
that should have been reset as stale. Replaced the separator with a
fixed-width big-endian length prefix per field (Type and each Option),
which is unambiguous regardless of content - this is what "canonical/
injective serialization" actually requires, and is why option identity in
this hash was still separator-based rather than delimiter-free lengths
even in the JSON version's design intent.

Added tests for both: server/router/api/v1/poll_definition_test.go covers
YAML parsing (block/flow style, defaulting to single-choice, UID
mismatch, malformed YAML, too few options) and the hash property directly
(formatting-invariance, the concatenation collision the length prefix
fixes, and the NUL-byte-smuggling case specifically) - the NUL-smuggling
test fails against the pre-fix hash implementation, confirming it
exercises the real bug. web/tests/poll-definition.test.ts covers the
same parsing surface from the frontend side.

Verified end to end against a live server: created a memo whose content
is exactly the target YAML block example, confirmed it round-trips
through save untouched, voted through the nested route, read back
matching tallies, and deleted the memo (exercising the poll/poll_vote
cascade cleanup) without error. Full go test ./... and the full frontend
vitest suite (1127 tests) both pass.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_016UZX8r5o3xdW8uKDTQv6Mb