Add random 4-digit TV token per child for obfuscated TV URLs

Each child is assigned a unique permanent tv_token on creation. The TV
dashboard URL (/tv/:tvToken) and WebSocket (/ws/:tvToken) now use this
token instead of the internal DB ID. Existing children are backfilled
on startup. README updated to reflect the change.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

backend/app/routers/dashboard.py

@@ -22,12 +22,13 @@ from app.utils.timer import compute_block_elapsed, compute_break_elapsed
 router = APIRouter(prefix="/api/dashboard", tags=["dashboard"])
 
 
-@router.get("/{child_id}", response_model=DashboardSnapshot)
-async def get_dashboard(child_id: int, db: AsyncSession = Depends(get_db)):
-    child_result = await db.execute(select(Child).where(Child.id == child_id, Child.is_active == True))
+@router.get("/{tv_token}", response_model=DashboardSnapshot)
+async def get_dashboard(tv_token: int, db: AsyncSession = Depends(get_db)):
+    child_result = await db.execute(select(Child).where(Child.tv_token == tv_token, Child.is_active == True))
     child = child_result.scalar_one_or_none()
     if not child:
         raise HTTPException(status_code=404, detail="Child not found")
+    child_id = child.id
 
     # Get today's active session
     session_result = await db.execute(