Drop the last legacy widget-system and shared-token auth scaffolding

Server: migration 41 drops the pre-widget-system Frame columns
(mode/album_id/current_asset_id/queue/calendar_*/whiteboard_*, etc)
docs/widgets.md flagged as the deliberately-deferred Phase 6 cleanup,
with a raw-SQL backfill safety net for any frame that still somehow
lacks a Widget. Also drops legacy_token_enabled and the shared
MANAGEMENT_TOKEN fallback it gated in require_device/require_browser --
the per-frame manage_token/device_token flow (and the /m/ page) fully
supersede it now; MANAGEMENT_TOKEN's only remaining role is the
optional pre-setup claim gate. Confirmed with the maintainer that the
deployed frame is already off the shared token before removing the
server-side fallback.

Firmware: the captive portal's "Access Token" field and its NVS/
build_url plumbing only ever mattered for pointing new firmware at an
old pre-multi-frame server -- gone along with the server-side fallback
it fed. Version bump to publish the change.

server/app/main.py

@@ -110,26 +110,16 @@ def service_worker() -> FileResponse:
     return FileResponse("app/static/sw.js", media_type="application/javascript")
 
 
-def _device_credential_redirect(request: Request, db, allow_legacy: bool) -> str | None:
+def _device_credential_redirect(request: Request, db) -> str | None:
     """The on-frame manage QR points at the server root with the device's
-    own credentials (new firmware: ?id=&token=; deployed firmware:
-    ?token=<legacy shared token>). Those scans get the frame's limited
-    manage page -- never the full UI, which requires a login.
-    allow_legacy is False before /setup has run: at that point a bare
-    ?token= hit is the admin coming through the token prompt to do
-    first-run setup, not a QR scan."""
+    own credentials (?id=&token=). Those scans get the frame's limited
+    manage page -- never the full UI, which requires a login."""
     device_id = request.query_params.get("id", "").strip().lower()
     token = request.query_params.get("token", "")
     if device_id and token:
         frame = db.scalars(select(Frame).where(Frame.device_id == device_id)).first()
         if frame is not None and token == frame.device_token:
             return f"/m/{frame.manage_token}"
-    if allow_legacy and token and management_token() and token == management_token():
-        frame = db.scalars(
-            select(Frame).where(Frame.legacy_token_enabled == True)  # noqa: E712
-        ).first()
-        if frame is not None:
-            return f"/m/{frame.manage_token}"
     return None
 
 
@@ -140,7 +130,7 @@ def index(request: Request):
     else is walked through setup/login."""
     with SessionLocal() as db:
         have_users = users_exist(db)
-        manage_redirect = _device_credential_redirect(request, db, allow_legacy=have_users)
+        manage_redirect = _device_credential_redirect(request, db)
         if manage_redirect is not None:
             return RedirectResponse(manage_redirect, status_code=303)