Drop the last legacy widget-system and shared-token auth scaffolding

Server: migration 41 drops the pre-widget-system Frame columns
(mode/album_id/current_asset_id/queue/calendar_*/whiteboard_*, etc)
docs/widgets.md flagged as the deliberately-deferred Phase 6 cleanup,
with a raw-SQL backfill safety net for any frame that still somehow
lacks a Widget. Also drops legacy_token_enabled and the shared
MANAGEMENT_TOKEN fallback it gated in require_device/require_browser --
the per-frame manage_token/device_token flow (and the /m/ page) fully
supersede it now; MANAGEMENT_TOKEN's only remaining role is the
optional pre-setup claim gate. Confirmed with the maintainer that the
deployed frame is already off the shared token before removing the
server-side fallback.

Firmware: the captive portal's "Access Token" field and its NVS/
build_url plumbing only ever mattered for pointing new firmware at an
old pre-multi-frame server -- gone along with the server-side fallback
it fed. Version bump to publish the change.

server/tests/conftest.py

@@ -112,6 +112,19 @@ def link_user(db: Session, user: User, frame: Frame) -> None:
     db.flush()
 
 
+def claim_device(db: Session, frame: Frame, device_id: str = "001122334455",
+                  token: str = "devtok-1") -> str:
+    """Gives `frame` device credentials and returns the "id=...&token=..."
+    query string real firmware always sends -- require_device has no
+    fallback for a bare /frame/* request without ?id= (the old shared-
+    MANAGEMENT_TOKEN/no-id path this project used to resolve to a single
+    legacy frame is gone), so any device-facing test needs this."""
+    frame.device_id = device_id
+    frame.device_token = token
+    db.commit()
+    return f"id={device_id}&token={token}"
+
+
 def login(client: TestClient, username: str, password: str = "testpass123") -> None:
     resp = client.post("/login", data={"username": username, "password": password})
     assert resp.status_code == 303, resp.text