Widget system Phase 4b: per-widget gear-icon config dialogs

Replaces the Photos/Calendar/Whiteboard tabs with a single Layout page
(now the frame's landing route) where each widget gets a gear icon
opening a dialog scoped to that specific widget's own settings. This
was the missing piece for genuinely independent same-type widgets --
"the Calendar tab" never made sense once a frame could hold more than
one calendar widget with different settings.

Data layer: FrameCalendar re-keyed from frame_id to widget_id, so each
calendar widget has its own independent included-calendars set. The
rekey runs as an unconditional post-startup step (like the existing
widget backfill), not a numbered migration -- it depends on calendar
widgets already existing, which themselves come from that same
backfill step, not from schema migration. Registering it as a numbered
migration would have run it first during a real upgrade, silently
dropping every row; caught by a new test that exercises the raw-SQL
upgrade path instead of the fresh-install create_all() shortcut every
other migration test takes.

API layer: every endpoint that used to assume "the frame's widget of
this type" (photo queue/thumbnail/preview, calendar select/color/
tasks/weather, whiteboard source/browse/preview) moved into
api_widgets.py under /api/frames/{id}/widgets/{widget_id}/..., with a
new require_widget_view/control dependency pair mirroring the existing
frame-level ones. Device status (battery/last-seen/firmware) got its
own frame-level /status endpoint, split out of the old photo-specific
/queue it used to piggyback on -- fixes the status bar going silently
blank on any frame without a photo widget.

UI layer: each widget type's existing settings markup/JS was ported
into a dialog partial + an explicit init/close function pair (the
content is now fetched and injected on demand, not loaded at page load
time). window.FRAME_API is repointed to the open dialog's widget-scoped
API base for its duration and restored on close; a separate
window.FRAME_BASE_API stays stable for the always-present header/
status-bar scripts.

Caught during manual browser testing: the consolidated config-save
endpoint initially expected a JSON body while the copied-over dialog JS
posts form-urlencoded data (the old convention) -- fixed to match, with
new HTTP-level test coverage that would have caught it immediately.

server/app/templates/frame_layout.html

@@ -18,8 +18,8 @@
         <h2 class="card-title">Widgets</h2>
         <p class="sub">Drag a widget to move it, drag its bottom-right corner
           to resize it -- like arranging widgets on a phone's home screen.
-          Widgets can't overlap. Each widget's own settings (which album,
-          which calendars, etc.) live on its type's own tab.</p>
+          Widgets can't overlap. Click a widget's gear icon for its own
+          settings (which album, which calendars, etc.).</p>
         <div id="widget-canvas-wrap">
           <div id="widget-canvas"></div>
         </div>
@@ -35,12 +35,24 @@
     </div>
   </div>
 
+  <dialog id="widget-dialog">
+    <button type="button" id="widget-dialog-close" class="icon-btn" aria-label="Close" title="Close">&times;</button>
+    <div id="widget-dialog-body"><p class="sub">Loading...</p></div>
+  </dialog>
+
   <div id="result"></div>
 {% endblock %}
 
 {% block scripts %}
-  <script>window.FRAME_API = {{ ("/api/frames/" ~ frame.id) | tojson }};</script>
+  <script>
+    window.FRAME_BASE_API = window.FRAME_API = {{ ("/api/frames/" ~ frame.id) | tojson }};
+    window.FRAME_ID = {{ frame.id | tojson }};
+  </script>
   <script src="/static/device_status_bar.js"></script>
   <script src="/static/frame_header.js"></script>
+  <script src="/static/widget_dialog_photos.js"></script>
+  <script src="/static/queue.js"></script>
+  <script src="/static/widget_dialog_calendar.js"></script>
+  <script src="/static/widget_dialog_whiteboard.js"></script>
   <script src="/static/frame_layout.js"></script>
 {% endblock %}