Store read-only receiver tokens as keyed digests and expose only sync_auth_configured in owner responses. Keep leader push tokens write-only in API responses because outbound sync still needs to send them.
Refs TUR-84
Add beamer config JSON, drop obsolete asset URL fields, and narrow display_state to the new beamer API states. Migration maps legacy display states to supported values and initializes config to {}.