Drop the last legacy widget-system and shared-token auth scaffolding

Server: migration 41 drops the pre-widget-system Frame columns
(mode/album_id/current_asset_id/queue/calendar_*/whiteboard_*, etc)
docs/widgets.md flagged as the deliberately-deferred Phase 6 cleanup,
with a raw-SQL backfill safety net for any frame that still somehow
lacks a Widget. Also drops legacy_token_enabled and the shared
MANAGEMENT_TOKEN fallback it gated in require_device/require_browser --
the per-frame manage_token/device_token flow (and the /m/ page) fully
supersede it now; MANAGEMENT_TOKEN's only remaining role is the
optional pre-setup claim gate. Confirmed with the maintainer that the
deployed frame is already off the shared token before removing the
server-side fallback.

Firmware: the captive portal's "Access Token" field and its NVS/
build_url plumbing only ever mattered for pointing new firmware at an
old pre-multi-frame server -- gone along with the server-side fallback
it fed. Version bump to publish the change.

server/tests/test_device_widget_dispatch.py

@@ -26,6 +26,8 @@ from app.models import (
     Widget,
 )
 
+from .conftest import claim_device
+
 EXPECTED_BYTES = 800 * 480 // 2
 _ASSETS = [{"id": "asset-1"}, {"id": "asset-2"}, {"id": "asset-3"}]
 
@@ -41,16 +43,17 @@ def _mock_immich(monkeypatch):
 def test_unclaimed_frame_shows_placeholder(client, db_session):
     frame = db_session.get(Frame, 1)
     frame.owner_user_id = None
-    db_session.commit()
+    creds = claim_device(db_session, frame)
 
-    resp = client.get("/frame/image")
+    resp = client.get(f"/frame/image?{creds}")
     assert resp.status_code == 200
     assert len(resp.content) == EXPECTED_BYTES
 
 
 def test_claimed_frame_with_unconfigured_photo_widget_still_renders(client, db_session):
     client.post("/setup", data={"username": "alice", "password": "hunter22"})
-    resp = client.get("/frame/image")
+    creds = claim_device(db_session, db_session.get(Frame, 1))
+    resp = client.get(f"/frame/image?{creds}")
     assert resp.status_code == 200
     assert len(resp.content) == EXPECTED_BYTES
 
@@ -66,24 +69,24 @@ def test_configured_photo_widget_renders_and_advances_via_button(client, db_sess
     widget = db_session.query(Widget).filter_by(frame_id=frame.id, widget_type="photos").one()
     cfg = db_session.get(PhotoWidgetConfig, widget.id)
     cfg.album_id = "album-1"
-    db_session.commit()
+    creds = claim_device(db_session, frame)
 
     _mock_immich(monkeypatch)
 
-    resp = client.get("/frame/image")
+    resp = client.get(f"/frame/image?{creds}")
     assert resp.status_code == 200
     assert len(resp.content) == EXPECTED_BYTES
 
     db_session.refresh(cfg)
     assert cfg.current_asset_id == "asset-1"
 
-    resp = client.post("/frame/advance")
+    resp = client.post(f"/frame/advance?{creds}")
     assert resp.status_code == 200
     assert len(resp.content) == EXPECTED_BYTES
     db_session.refresh(cfg)
     assert cfg.current_asset_id != "asset-1"  # the default next->advance binding fired
 
-    resp = client.post("/frame/back")
+    resp = client.post(f"/frame/back?{creds}")
     assert resp.status_code == 200
     db_session.refresh(cfg)
     assert cfg.current_asset_id == "asset-1"  # back undid it
@@ -94,11 +97,11 @@ def test_manage_flag_still_returns_a_valid_image(client, db_session, monkeypatch
     frame = db_session.get(Frame, 1)
     widget = db_session.query(Widget).filter_by(frame_id=frame.id, widget_type="photos").one()
     db_session.get(PhotoWidgetConfig, widget.id).album_id = "album-1"
-    db_session.commit()
+    creds = claim_device(db_session, frame)
     _mock_immich(monkeypatch)
 
-    plain = client.get("/frame/image").content
-    with_manage = client.get("/frame/image?manage=1").content
+    plain = client.get(f"/frame/image?{creds}").content
+    with_manage = client.get(f"/frame/image?{creds}&manage=1").content
     assert len(with_manage) == EXPECTED_BYTES
     assert with_manage != plain  # the manage-QR overlay actually got composited in