Drop the last legacy widget-system and shared-token auth scaffolding

Server: migration 41 drops the pre-widget-system Frame columns
(mode/album_id/current_asset_id/queue/calendar_*/whiteboard_*, etc)
docs/widgets.md flagged as the deliberately-deferred Phase 6 cleanup,
with a raw-SQL backfill safety net for any frame that still somehow
lacks a Widget. Also drops legacy_token_enabled and the shared
MANAGEMENT_TOKEN fallback it gated in require_device/require_browser --
the per-frame manage_token/device_token flow (and the /m/ page) fully
supersede it now; MANAGEMENT_TOKEN's only remaining role is the
optional pre-setup claim gate. Confirmed with the maintainer that the
deployed frame is already off the shared token before removing the
server-side fallback.

Firmware: the captive portal's "Access Token" field and its NVS/
build_url plumbing only ever mattered for pointing new firmware at an
old pre-multi-frame server -- gone along with the server-side fallback
it fed. Version bump to publish the change.

server/app/templates/admin.html

@@ -109,20 +109,12 @@
               &middot; linked: {{ links_by_frame.get(f.id, []) | map(attribute="username") | join(", ") or "nobody" }}<br>
               firmware: {{ f.device_firmware_version or "?" }} ({{ f.device_board_variant or "board unknown" }})
               &middot; token ack: {{ "yes" if f.device_token_ack else "no" }}
-              {% if f.legacy_token_enabled %}&middot; <strong>legacy token window OPEN</strong>{% endif %}
             </p>
             <form method="post" action="/admin/frames/{{ f.id }}/link-user" class="admin-inline-form">
               <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
               <input type="text" name="username" placeholder="Link user by name" required>
               <button type="submit" class="secondary btn-inline">Link</button>
             </form>
-            {% if f.legacy_token_enabled %}
-              <form method="post" action="/admin/frames/{{ f.id }}/end-legacy" class="admin-inline-form"
-                    onsubmit="return confirm('Close the legacy-token window for frame #{{ f.id }}? Only do this once the device has acknowledged its own token.');">
-                <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
-                <button type="submit" class="secondary btn-inline">Close legacy window</button>
-              </form>
-            {% endif %}
             <form method="post" action="/admin/frames/{{ f.id }}/delete" class="admin-inline-form"
                   onsubmit="return confirm('Delete frame #{{ f.id }} and all its history?');">
               <input type="hidden" name="csrf_token" value="{{ csrf_token }}">