Split voting into clean read/write endpoints

Replaces the GET-mutates-state interactions route with a proper split:
- GET  /entry/{pid}/votes  reads the tally (public, read-only)
- POST /entry/{pid}/vote   casts/toggles the vote (auth, mode in body)

Shared voteTally/writeTally helpers back both handlers. Invalid mode now
returns 400. Frontend updated to read via GET and vote via POST.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/js/app.js

@@ -111,12 +111,15 @@ function setupVoting(el, pid) {
 
   buttons.forEach((b) =>
     b.addEventListener("click", async () => {
-      render(await api.get(`/entry/${pid}/interactions/${b.dataset.mode}`));
+      const fd = new FormData();
+      fd.append("mode", b.dataset.mode);
+      const res = await api.post(`/entry/${pid}/vote`, fd);
+      render(res.data);
     })
   );
 
-  // Anfangszustand laden, ohne zu werten.
-  api.get(`/entry/${pid}/interactions/none`).then(render);
+  // Anfangszustand laden (read-only).
+  api.get(`/entry/${pid}/votes`).then(render);
 }
 
 async function loadMore() {