Poll creators are locked out of their own polls; strangers can edit anyone's

Any authenticated user can currently PATCH (deactivate) any other user's poll -- a poll's creator has zero special standing except that they, specifically, are the one person forbidden from touching it. In practice: a user creates a poll, a completely unrelated user closes it out from under them, and the creator gets a 403 Forbidden if they try to fix it themselves. This is a genuine authorization bug (anyone can tamper with anyone else's poll) as well as a usability dead end (the actual owner can't manage their own content), and it's the kind of thing that generates angry support tickets ("why can't I edit my own poll?") right alongside abuse reports ("someone closed my poll and I don't know who").

IsCreatorOrReadOnly.has_object_permission is supposed to allow write access only to a poll's creator (reads are already open to everyone via SAFE_METHODS). As written, it grants write access to everyone except the creator.

cd django/poll_app source .venv/bin/activate python manage.py runserver &

curl -s -X POST http://127.0.0.1:8000/api/auth/register/ -H "Content-Type: application/json"
-d '{"username":"dave","email":"dave@example.com","password":"d-strong-password-1"}' curl -s -X POST http://127.0.0.1:8000/api/auth/register/ -H "Content-Type: application/json"
-d '{"username":"erin","email":"","password":"e-strong-password-2"}'

This single comparison is the entire enforcement of "only the creator can modify their poll" -- there's no other check anywhere in PollViewSet. It's also already covered by two pre-existing tests in polls/tests/test_api.py (test_creator_can_deactivate_poll and test_non_creator_cannot_deactivate_poll), which currently fail because of it.

Look at exactly one line in polls/permissions.py -- has_object_permission -- and what a boolean comparison operator needs to mean for "is this user not the creator, so we should read-only them" versus "is this user the creator, so we should let them write."