Upgrade kaya to 0.0.6

kaya-oidc 0.0.6 namespaces its session state per provider as
oidc:{provider}:user (the default provider is "default", so the key is
oidc:default:user). The unprefixed oidc_user key is no longer written:
left unadapted, every websocket upgrade would be rejected with 401 and
traced requests would silently lose their user.id attribute. Adopt it
with a session_user helper on tavolo.platform.auth that finds any
provider's user, used by both get_ws_user and telemetry's
session_tag_hook. Websocket and route handlers keep their signatures.

kaya-otel 0.0.6 only enriches websocket spans with standard URL, network
and peer attributes (plus error.type), which needs no application change.

Regenerate the lock: the eight kaya pins move to 0.0.6 and, the wheels'
declared metadata being unchanged, nothing else moves. tavolo-platform
now floors kaya-core>=0.0.6 (it reads the new session layout) and
tavolo-app floors kaya-otel>=0.0.6.

As kaya documents, the session-key move signs existing logged-in users
out once; they simply log in again.

server/packages/tavolo-app/pyproject.toml

@@ -34,7 +34,7 @@ dev = [
     "httpx-ws",
 ]
 otel = [
-    "kaya-otel>=0.0.5",
+    "kaya-otel>=0.0.6",
     "opentelemetry-instrumentation-asyncpg>=0.66b0",
     "opentelemetry-instrumentation-redis>=0.66b0",
     "opentelemetry-instrumentation-system-metrics>=0.66b0",

server/packages/tavolo-app/src/tavolo/telemetry.py

@@ -28,12 +28,13 @@ import hashlib
 import logging
 from dataclasses import dataclass
 from logging import getLogger
-from typing import TYPE_CHECKING, Any, Dict, Mapping, Optional, Union
+from typing import TYPE_CHECKING, Any, Dict, Optional, Union
 
 from kaya.core import KayaApp, KayaMixin
 from kaya.session import InMemorySessionStore, SessionStore
 from kaya.session.redis import RedisSessionStore
 from redis.asyncio import Redis
+from tavolo.platform.auth import session_user
 from tavolo.platform.store import GameStore
 
 from .config import Settings
@@ -108,8 +109,8 @@ def session_tag_hook(span: Any, carrier: Any) -> None:
             "session.id",
             hashlib.sha256(session_id.encode()).hexdigest()[:16],
         )
-    user = session.get("oidc_user")
-    if isinstance(user, Mapping):
+    user = session_user(session)
+    if user is not None:
         sub = user.get("sub")
         if sub:
             span.set_attribute("user.id", str(sub))