Fix scan-to-download auth and share every photo widget's current photo

The share QR's URL carried no auth params at all, so it silently fell
back through require_device's legacy-token resolution to whichever
frame happened to still be flagged legacy -- working only by accident
for a single frame, sharing the wrong frame's photos for any other, and
going fully dead once that frame's legacy flag was cleared.

Move the endpoint to manage.py, keyed on the frame's own manage_token
(same pattern /m/<manage_token> already uses) instead of device auth.
Since the server now resolves assets itself instead of trusting a
caller-supplied asset_id, it naturally generalizes to gather every
photo widget's current photo into one Immich share link, not just one
"primary" widget's.

server/app/routers/api_widgets.py

@@ -493,8 +493,8 @@ def api_widget_thumbnail(
     """Scoped to what this widget is actually showing/queuing -- a user
     merely linked to view this frame shouldn't be able to pull thumbnails
     for arbitrary asset ids in the owner's Immich library, only this
-    widget's own curated album. Same rule device.frame_share and
-    manage.manage_thumbnail already enforce."""
+    widget's own curated album. Same rule manage.manage_thumbnail
+    already enforces."""
     frame, widget = frame_widget
     _require_widget_type(widget, "photos")
     pcfg = db.get(PhotoWidgetConfig, widget.id)