Drop the last legacy widget-system and shared-token auth scaffolding

Server: migration 41 drops the pre-widget-system Frame columns
(mode/album_id/current_asset_id/queue/calendar_*/whiteboard_*, etc)
docs/widgets.md flagged as the deliberately-deferred Phase 6 cleanup,
with a raw-SQL backfill safety net for any frame that still somehow
lacks a Widget. Also drops legacy_token_enabled and the shared
MANAGEMENT_TOKEN fallback it gated in require_device/require_browser --
the per-frame manage_token/device_token flow (and the /m/ page) fully
supersede it now; MANAGEMENT_TOKEN's only remaining role is the
optional pre-setup claim gate. Confirmed with the maintainer that the
deployed frame is already off the shared token before removing the
server-side fallback.

Firmware: the captive portal's "Access Token" field and its NVS/
build_url plumbing only ever mattered for pointing new firmware at an
old pre-multi-frame server -- gone along with the server-side fallback
it fed. Version bump to publish the change.

server/docker-compose.yml.example

@@ -10,12 +10,11 @@ services:
       - CONFIG_PATH=/data/config.json
       - IMMICH_URL=http://your-immich-host:2283
       - IMMICH_API_KEY=your-immich-api-key-here
-      # Optional: gates the entire server -- the web UI (/, /api/*) AND
-      # every device-facing /frame/* endpoint -- behind this shared secret.
-      # Leave unset to keep it all open on a trusted LAN, same as before.
-      # Paste the same value into the ESP32's captive portal setup form
-      # (Access Token field) so it's sent on every device request and gets
-      # embedded automatically in the manage-menu/share QR codes.
+      # Optional: gates first-run /setup on a freshly deployed server --
+      # whoever supplies this value is the one who gets to create the
+      # first admin account. Meaningless once that account exists (every
+      # other route always requires a real login), so leave unset unless
+      # you're worried about someone else reaching /setup before you do.
       - MANAGEMENT_TOKEN=changeme
       # Optional: only needed if the Gitea repo configured in the web UI's
       # "Firmware Gitea repo URL" field is private. A read-only PAT is