Widget system Phase 1: per-type render/action modules

New app/widgets/ package (photos.py, calendar.py, whiteboard.py, plus
the WIDGET_TYPES registry) -- the widget-system analogue of
routers/device.py's old RENDERERS/ADVANCE_RENDERERS/BACK_RENDERERS,
generalized from "one mode owns the whole panel" to "each widget renders
into its own region and responds to named button actions." Each module
exposes render(db, frame, widget, target_w, target_h) -> Image.Image
(never raises -- a widget's own fetch hiccup falls back to a small
placeholder rather than taking the whole panel's render down) and an
ACTIONS registry for NEXT/BACK button assignment.

Supporting changes needed to give the widget modules something to call,
all mechanical/behavior-preserving for every existing caller:

- image_pipeline.py: render_panel(regions, ...) generalizes render_frame's
  tail (paste, enhance once, overlay once, quantize once, pack once) from
  one photo to N regions -- not a restructuring, since calendar mode's
  photo-inlay feature already pastes a second composed image onto the
  canvas before that single shared pipeline runs.
- photo_queue.py: advance_forced/back_forced/remove_from_rotation/
  get_current take an explicit `frame` param now that `cfg` won't always
  be the Frame itself once photo-queue state moves to PhotoWidgetConfig
  -- caught a real latent bug while doing this: get_current was reading
  refresh_interval_s off `cfg`, but that's a frame-level wake-cadence
  setting, not something that becomes per-widget, so it now reads that
  off `frame` explicitly instead.
- routers/common.py: list_assets/fetch_source_and_faces take album_id/
  display_mode directly instead of a whole Frame (both only ever read
  that one attribute off it); new get_or_refresh_*_for_widget siblings
  of the existing calendar/weather/tasks/whiteboard cache helpers, read/
  writing the new per-widget config tables -- the Frame-scoped originals
  are untouched and still what routers/device.py's actual dispatch calls
  until the Phase 2 cutover.

26 new tests (95 total): render_panel size/placement/orientation
coverage, and per-widget-type render/action tests (unconfigured ->
placeholder, a fetch failure -> placeholder not a crash, actions mutate
the right state). Full suite passes; diff-reviewed to confirm
device.py's actual RENDERERS dispatch and the old Frame-scoped
get_or_refresh_* bodies are unchanged, so this is safe to deploy on its
own despite being step 1 of a two-step cutover (see the project plan on
why the *next* step, not this one, has to ship atomically).

server/tests/test_widgets_photos.py

@@ -0,0 +1,116 @@
+"""app.widgets.photos -- unit-level, no HTTP: constructs Widget/
+PhotoWidgetConfig rows directly and monkeypatches the Immich-facing
+calls (list_assets/fetch_source_and_faces/immich_client_for) rather than
+standing up a fake Immich server, since this module's own logic (what it
+does with whatever Immich returns) is what's under test, not Immich's
+API shape -- already covered by ImmichClient's own tests if any, and by
+this suite's HTTP-level permission-boundary tests elsewhere."""
+
+from __future__ import annotations
+
+import time
+
+from PIL import Image
+
+from app import widgets
+from app.db import widget_locked
+from app.models import Frame, PhotoWidgetConfig, Widget
+
+_ASSETS = [{"id": "asset-1"}, {"id": "asset-2"}, {"id": "asset-3"}]
+
+
+def _make_widget(db_session, album_id="album-1") -> tuple[Frame, Widget]:
+    frame = db_session.get(Frame, 1)
+    widget = Widget(frame_id=frame.id, widget_type="photos", x=0, y=0, w=8, h=5,
+                    sort_order=0, created_at=time.time())
+    db_session.add(widget)
+    db_session.flush()
+    db_session.add(PhotoWidgetConfig(widget_id=widget.id, album_id=album_id, queue_target_len=5))
+    db_session.commit()
+    return frame, widget
+
+
+def test_render_unconfigured_widget_returns_correctly_sized_placeholder(db_session):
+    frame, widget = _make_widget(db_session, album_id="")
+    img = widgets.photos.render(db_session, frame, widget, 400, 300)
+    assert img.size == (400, 300)
+    assert img.mode == "RGB"
+
+
+def test_render_configured_widget_composes_a_photo(db_session, monkeypatch):
+    frame, widget = _make_widget(db_session)
+
+    monkeypatch.setattr(widgets.photos, "immich_client_for", lambda frame: object())
+    monkeypatch.setattr(widgets.photos, "list_assets", lambda client, album_id: _ASSETS)
+    source = Image.new("RGB", (100, 80), (10, 20, 30))
+    monkeypatch.setattr(widgets.photos, "fetch_source_and_faces", lambda client, mode, asset_id: (source, None))
+
+    img = widgets.photos.render(db_session, frame, widget, 400, 300)
+    assert img.size == (400, 300)
+
+    cfg = db_session.get(PhotoWidgetConfig, widget.id)
+    assert cfg.current_asset_id == "asset-1"  # get_current picked the first asset
+
+
+def test_render_falls_back_to_placeholder_on_immich_failure(db_session, monkeypatch):
+    from fastapi import HTTPException
+
+    frame, widget = _make_widget(db_session)
+
+    def _raise(client, album_id):
+        raise HTTPException(502, "Could not reach Immich")
+
+    monkeypatch.setattr(widgets.photos, "immich_client_for", lambda frame: object())
+    monkeypatch.setattr(widgets.photos, "list_assets", _raise)
+
+    img = widgets.photos.render(db_session, frame, widget, 400, 300)
+    assert img.size == (400, 300)  # placeholder, not a crash
+
+
+def test_advance_action_moves_to_next_photo(db_session, monkeypatch):
+    frame, widget = _make_widget(db_session)
+    monkeypatch.setattr(widgets.photos, "immich_client_for", lambda frame: object())
+    monkeypatch.setattr(widgets.photos, "list_assets", lambda client, album_id: _ASSETS)
+
+    with widget_locked(db_session, frame.id, widget.id) as (_, _, cfg):
+        cfg.current_asset_id = "asset-1"
+
+    widgets.photos.ACTIONS["advance"](db_session, frame, widget)
+
+    cfg = db_session.get(PhotoWidgetConfig, widget.id)
+    assert cfg.current_asset_id != "asset-1"
+    assert cfg.history == ["asset-1"]
+
+
+def test_back_action_undoes_advance(db_session, monkeypatch):
+    frame, widget = _make_widget(db_session)
+    monkeypatch.setattr(widgets.photos, "immich_client_for", lambda frame: object())
+    monkeypatch.setattr(widgets.photos, "list_assets", lambda client, album_id: _ASSETS)
+
+    # advance_forced only pushes the *previous* current photo onto history
+    # -- the very first advance from an empty current_asset_id has nothing
+    # to push, so a second advance is needed before there's anything for
+    # "back" to undo.
+    widgets.photos.ACTIONS["advance"](db_session, frame, widget)
+    first = db_session.get(PhotoWidgetConfig, widget.id).current_asset_id
+    widgets.photos.ACTIONS["advance"](db_session, frame, widget)
+    second = db_session.get(PhotoWidgetConfig, widget.id).current_asset_id
+    assert second != first
+
+    widgets.photos.ACTIONS["back"](db_session, frame, widget)
+    cfg = db_session.get(PhotoWidgetConfig, widget.id)
+    assert cfg.current_asset_id == first
+
+
+def test_advance_action_is_a_no_op_when_unconfigured(db_session):
+    frame, widget = _make_widget(db_session, album_id="")
+    widgets.photos.ACTIONS["advance"](db_session, frame, widget)  # must not raise
+    cfg = db_session.get(PhotoWidgetConfig, widget.id)
+    assert cfg.current_asset_id == ""
+
+
+def test_advance_uses_the_frame_stats_counter_not_the_widget_config():
+    """advance_forced's frame/stats split (see app/photo_queue.py) means
+    stats_photos_displayed should land on the Frame row, never on
+    PhotoWidgetConfig (which has no such column at all)."""
+    assert not hasattr(PhotoWidgetConfig, "stats_photos_displayed")