Upgrade kaya to 0.0.6

kaya-oidc 0.0.6 namespaces its session state per provider as
oidc:{provider}:user (the default provider is "default", so the key is
oidc:default:user). The unprefixed oidc_user key is no longer written:
left unadapted, every websocket upgrade would be rejected with 401 and
traced requests would silently lose their user.id attribute. Adopt it
with a session_user helper on tavolo.platform.auth that finds any
provider's user, used by both get_ws_user and telemetry's
session_tag_hook. Websocket and route handlers keep their signatures.

kaya-otel 0.0.6 only enriches websocket spans with standard URL, network
and peer attributes (plus error.type), which needs no application change.

Regenerate the lock: the eight kaya pins move to 0.0.6 and, the wheels'
declared metadata being unchanged, nothing else moves. tavolo-platform
now floors kaya-core>=0.0.6 (it reads the new session layout) and
tavolo-app floors kaya-otel>=0.0.6.

As kaya documents, the session-key move signs existing logged-in users
out once; they simply log in again.

server/requirements.txt

@@ -63,7 +63,7 @@ idna==3.20
     #   httpx
 iso8601==2.1.0
     # via tortoise-orm
-kaya-core==0.0.5
+kaya-core==0.0.6
     # via
     #   kaya-cors
     #   kaya-oidc
@@ -72,22 +72,22 @@ kaya-core==0.0.5
     #   kaya-rsgi
     #   kaya-session
     #   tavolo-app (pyproject.toml)
-kaya-cors==0.0.5
+kaya-cors==0.0.6
     # via tavolo-app (pyproject.toml)
-kaya-oidc==0.0.5
+kaya-oidc==0.0.6
     # via tavolo-app (pyproject.toml)
-kaya-openapi==0.0.5
+kaya-openapi==0.0.6
     # via tavolo-app (pyproject.toml)
-kaya-otel==0.0.5
+kaya-otel==0.0.6
     # via tavolo-app (pyproject.toml)
-kaya-rsgi==0.0.5
+kaya-rsgi==0.0.6
     # via tavolo-app (pyproject.toml)
-kaya-session==0.0.5
+kaya-session==0.0.6
     # via
     #   kaya-oidc
     #   kaya-session-redis
     #   tavolo-app (pyproject.toml)
-kaya-session-redis==0.0.5
+kaya-session-redis==0.0.6
     # via tavolo-app (pyproject.toml)
 opentelemetry-api==1.45.0
     # via