chore(slideshow): renumber migrations to 138/139 (after whatsapp #649's 137)

PR #649 takes migration 137 (add_whatsapp_template_language). Renumber the
slideshow migrations to slot in after it:
- 137_add_slideshow_share.js  -> 138_add_slideshow_share.js
- 138_add_slideshow_styling.js -> 139_add_slideshow_styling.js
and update the slideshow migration-number references in comments/types. No
content change — both are additive + addColumnIfNotExists-guarded, so re-running
under the new filename on an already-migrated DB is a safe no-op.

backend/src/routes/adminEvents.js

@@ -1882,7 +1882,7 @@ router.post('/:id/toggle-status', adminAuth, requirePermission('events.edit'), r
 
 // ---------------------------------------------------------------------------
 // Live Slideshow ("Diashow") — a token-only fullscreen kiosk link for live
-// events that auto-picks-up new uploads (migration 137). Mirrors the
+// events that auto-picks-up new uploads (migration 138). Mirrors the
 // client-access second-token pattern: the link is minted on demand, rotatable
 // and disable-able, independent of the gallery password / share link.
 // ---------------------------------------------------------------------------

backend/src/routes/adminSettings.js

@@ -290,7 +290,7 @@ router.put('/accounting', adminAuth, requirePermission('settings.edit'), async (
   }
 });
 
-// Global Live Slideshow defaults (migration 138). The per-event watermark is
+// Global Live Slideshow defaults (migration 139). The per-event watermark is
 // tri-state (events.show_watermark NULL = inherit these). Read via the generic
 // GET /:type ('slideshow'); this is the typed write.
 router.put('/slideshow', adminAuth, requirePermission('settings.edit'), async (req, res) => {

backend/src/routes/gallery.js

@@ -220,7 +220,7 @@ router.get('/:slug/info', async (req, res) => {
 
 // ---------------------------------------------------------------------------
 // Live Slideshow ("Diashow") — token-only fullscreen kiosk surface
-// (migration 137). The token in the URL IS the secret (no gallery password),
+// (migration 138). The token in the URL IS the secret (no gallery password),
 // so these routes are unauthenticated except for the token match itself. The
 // slideshow shows ALL public/visible, finished photos — exactly the guest
 // set — so once /session mints a short-lived `accessLevel:'slideshow'` JWT,
@@ -586,7 +586,7 @@ router.get('/:slug/photos', verifyGalleryAccess, resolveGuest, async (req, res)
     // Log view — but NOT for the Live Slideshow kiosk. A running projector
     // refetches this list on every new-upload poll, which would massively
     // inflate total_views / unique_visitors. The slideshow is explicitly
-    // excluded from real visitor analytics (migration 137 design).
+    // excluded from real visitor analytics (migration 138 design).
     if (req.accessLevel !== 'slideshow') {
       await db('access_logs').insert({
         event_id: req.event.id,