Drop the last legacy widget-system and shared-token auth scaffolding

Server: migration 41 drops the pre-widget-system Frame columns
(mode/album_id/current_asset_id/queue/calendar_*/whiteboard_*, etc)
docs/widgets.md flagged as the deliberately-deferred Phase 6 cleanup,
with a raw-SQL backfill safety net for any frame that still somehow
lacks a Widget. Also drops legacy_token_enabled and the shared
MANAGEMENT_TOKEN fallback it gated in require_device/require_browser --
the per-frame manage_token/device_token flow (and the /m/ page) fully
supersede it now; MANAGEMENT_TOKEN's only remaining role is the
optional pre-setup claim gate. Confirmed with the maintainer that the
deployed frame is already off the shared token before removing the
server-side fallback.

Firmware: the captive portal's "Access Token" field and its NVS/
build_url plumbing only ever mattered for pointing new firmware at an
old pre-multi-frame server -- gone along with the server-side fallback
it fed. Version bump to publish the change.

CLAUDE.md

@@ -15,8 +15,7 @@ Start here, don't re-derive from scratch:
 - [`docs/architecture.md`](docs/architecture.md) -- how firmware and
   server talk (sequence diagram, boot flow).
 - [`docs/widgets.md`](docs/widgets.md) -- the server-side widget system
-  (data model, grid placement, compositor, button-action dispatch). Notes
-  a known gap at the bottom (legacy `Frame` columns not yet dropped).
+  (data model, grid placement, compositor, button-action dispatch).
 - [`docs/hardware.md`](docs/hardware.md) -- wiring.
 - [`server/README.md`](server/README.md), [`firmware/README.md`](firmware/README.md)
   -- per-component setup, config, and a lot of accumulated gotchas