feat: phase 2 widgets — registry, fetchers, clock, config dialog

Backend: internal/widget registry (type metadata + Fetcher), Pi-hole
v5 / AdGuard / Immich fetchers, /api/widgets/types + /api/widgets/:id/data
with 30s TTL cache (failures cached too), kind+config on item create/patch.
Config secrets are never logged or echoed in errors.

Frontend: WidgetContent host maps config.type to a component, polls
/data every 30s for server-backed types; clock renders client-side.
Generic WidgetDialog builds its form from the registry's field list.
Widget tiles are sortable items in both renderers.

Generated with [Devin](https://devin.ai)

Authored By: TDvorak <[email protected]>
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/widget/clock.go

@@ -0,0 +1,29 @@
+package widget
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+)
+
+// Clock renders client-side — it registers only so /api/widgets/types lists
+// it and the add-widget dialog can offer it like any other type.
+type clock struct{}
+
+func init() { register(clock{}) }
+
+func (clock) Meta() Type {
+	return Type{
+		Type:        "clock",
+		Name:        "Clock",
+		Description: "Local time in any timezone",
+		Local:       true,
+		Fields: []Field{
+			{Key: "timezone", Label: "Timezone", Placeholder: "Europe/Prague — blank = local"},
+		},
+	}
+}
+
+func (clock) Fetch(context.Context, json.RawMessage) (any, error) {
+	return nil, fmt.Errorf("clock renders client-side")
+}