Drop the last legacy widget-system and shared-token auth scaffolding

Server: migration 41 drops the pre-widget-system Frame columns
(mode/album_id/current_asset_id/queue/calendar_*/whiteboard_*, etc)
docs/widgets.md flagged as the deliberately-deferred Phase 6 cleanup,
with a raw-SQL backfill safety net for any frame that still somehow
lacks a Widget. Also drops legacy_token_enabled and the shared
MANAGEMENT_TOKEN fallback it gated in require_device/require_browser --
the per-frame manage_token/device_token flow (and the /m/ page) fully
supersede it now; MANAGEMENT_TOKEN's only remaining role is the
optional pre-setup claim gate. Confirmed with the maintainer that the
deployed frame is already off the shared token before removing the
server-side fallback.

Firmware: the captive portal's "Access Token" field and its NVS/
build_url plumbing only ever mattered for pointing new firmware at an
old pre-multi-frame server -- gone along with the server-side fallback
it fed. Version bump to publish the change.

server/tests/test_global_actions.py

@@ -19,7 +19,7 @@ from app.models import (
     WhiteboardWidgetConfig,
 )
 
-from .conftest import csrf_headers, link_user, login, make_user
+from .conftest import claim_device, csrf_headers, link_user, login, make_user
 
 EXPECTED_BYTES = 800 * 480 // 2
 
@@ -113,7 +113,8 @@ def test_save_logged_out_401s(client, db_session):
 
 def test_global_next_is_a_noop_when_unset(client, db_session):
     client.post("/setup", data={"username": "alice", "password": "hunter22"})
-    resp = client.post("/frame/global-next")
+    creds = claim_device(db_session, db_session.get(Frame, 1))
+    resp = client.post(f"/frame/global-next?{creds}")
     assert resp.status_code == 200
     assert len(resp.content) == EXPECTED_BYTES
 
@@ -123,9 +124,9 @@ def test_global_next_runs_the_configured_action(client, db_session):
     frame = db_session.get(Frame, 1)
     photo_widget_id = db_session.query(Widget).filter_by(frame_id=frame.id, widget_type="photos").one().id
     frame.next_hold_action = "toggle_all_photo_locks"
-    db_session.commit()
+    creds = claim_device(db_session, frame)
 
-    resp = client.post("/frame/global-next")
+    resp = client.post(f"/frame/global-next?{creds}")
     assert resp.status_code == 200
     assert len(resp.content) == EXPECTED_BYTES
     assert db_session.get(PhotoWidgetConfig, photo_widget_id).locked is True
@@ -136,9 +137,9 @@ def test_global_back_runs_the_configured_action(client, db_session):
     frame = db_session.get(Frame, 1)
     photo_widget_id = db_session.query(Widget).filter_by(frame_id=frame.id, widget_type="photos").one().id
     frame.back_hold_action = "toggle_all_photo_locks"
-    db_session.commit()
+    creds = claim_device(db_session, frame)
 
-    resp = client.post("/frame/global-back")
+    resp = client.post(f"/frame/global-back?{creds}")
     assert resp.status_code == 200
     assert db_session.get(PhotoWidgetConfig, photo_widget_id).locked is True
 
@@ -149,9 +150,9 @@ def test_global_next_with_an_unrecognized_stored_action_is_a_noop(client, db_ses
     client.post("/setup", data={"username": "alice", "password": "hunter22"})
     frame = db_session.get(Frame, 1)
     frame.next_hold_action = "no_longer_exists"
-    db_session.commit()
+    creds = claim_device(db_session, frame)
 
-    resp = client.post("/frame/global-next")
+    resp = client.post(f"/frame/global-next?{creds}")
     assert resp.status_code == 200
     assert len(resp.content) == EXPECTED_BYTES