Refactor to composable KayaMixin architecture

Replace wrapper-based SessionMiddleware/OIDCApp with KayaMixin subclasses
applied via KayaApp(mixins=[...]). Mixins hook into handle_request and
handle_websocket via before/after hooks, so both ASGI and RSGI keep working.
Mixin dependencies are applied automatically and deduplicated.

packages/kaya-session/README.md

@@ -9,12 +9,12 @@ session data is accessible from request handlers as `ctx.session`.
 
 ```python
 from kaya.core import KayaApp, HttpContext
-from kaya.session import SessionMiddleware, InMemorySessionStore
+from kaya.session import SessionMixin, InMemorySessionStore
 
-app = KayaApp()
-session_app = SessionMiddleware(app, InMemorySessionStore())
+session = SessionMixin(InMemorySessionStore())
+app = KayaApp(mixins=[session])
 
-@session_app.GET('/')
+@app.GET('/')
 async def home(ctx: HttpContext):
     n = ctx.session.get('visits', 0) + 1
     ctx.session['visits'] = n
@@ -24,11 +24,14 @@ async def home(ctx: HttpContext):
 Sessions are created lazily: a cookie is only set when the handler modifies the
 session.
 
+`SessionMixin` is a `KayaMixin`, so the app stays a `KayaApp` and both ASGI and
+RSGI keep working.
+
 ## Session expiry
 
 The cookie sent to the browser has a `Max-Age` (default 14 days), but that is
 only a client-side hint. The real boundary is the store's server-side TTL,
-which the middleware keeps in sync with the cookie `Max-Age`.
+which the mixin keeps in sync with the cookie `Max-Age`.
 
 For `InMemorySessionStore`, a session expires if it is idle for longer than
 `max_age`. Active sessions have their expiry slid forward on every access, so
@@ -44,14 +47,12 @@ attribute) entirely.
 - `Session`: dict-like session object with modification tracking
 - `SessionStore`: abstract store interface
 - `InMemorySessionStore`: simple in-memory store for development/single-process
-- `SessionMiddleware`: ASGI middleware managing session cookies and persistence
+- `SessionMixin`: composable Kaya mixin managing session cookies and persistence
 - Session ID regeneration (`session.regenerate_id()`) and invalidation
-  (`session.invalidate()`) for future authentication layers
+  (`session.invalidate()`) for authentication layers
 
 ## Notes
 
-- This release supports HTTP requests only; WebSocket and RSGI propagation is
-  planned for future releases.
 - `InMemorySessionStore` does not survive process restarts and is not shared
   across processes. Production deployments should use a store backed by a shared
   storage system (planned).