Fix OIDC subject collisions by introducing canonical provider-plus-subject principals

- Add canonical_principal(provider, sub) => 'oidc:v1:<provider>:<sub>'
- Preserve provider identity across HTTP sessions and WebSockets
- Apply principals throughout: game creation/joining/seating, WebSocket views/actions,
  Redis engine state, match history, leaderboard focus, ratings, /api/me, OpenAPI,
  and telemetry
- Widen identity columns to 1024 chars with schema-only aerich migration (5_20261024221522_canonical_principals.py)
- Document provider names as stable security identifiers
- Add regression tests: same subject at different providers cannot share games, private hands,
  join codes, moves, history, or ratings; distinct seat and rating ownership verified
- All platform, integration, game, and frontend tests pass; mypy clean

server/README.md

@@ -138,9 +138,12 @@ bookmarks and scripts), and `GET /auth/logout` signs out whichever
 provider the session is logged in with.
 
 Sessions hold a single identity: logging in with another provider
-replaces the previous one. Each provider's `sub` is a separate account,
-so match history and Elo ratings are per provider identity (someone using
-two providers has two accounts). Migrating from the pre-0.0.6 unindexed
+replaces the previous one. Accounts are keyed by the canonical principal
+`oidc:v1:<provider>:<sub>`, not by `sub` alone, so equal subjects at two
+providers cannot share games, history, or ratings (someone using two
+providers has two accounts). Provider names are permanent security
+identifiers: do not reuse a name for a different issuer, and treat renaming
+one as an identity migration. Migrating from the pre-0.0.6 unindexed
 variables: rename `OIDC_ISSUER`/`OIDC_CLIENT_ID`/... to `OIDC_0_...`, add
 `OIDC_0_PROVIDER`, and register the new callback path
 (`/auth/<provider>/callback`) at the provider. Sessions survive only when
@@ -249,8 +252,9 @@ aggregate with `max`, not `sum`.
   per-deal audit; for briscola chiamata: the calling side's points
   against the defenders', the declared target, the called card and
   whether the caller played alone).
-- `match_player` — one row per participant: the OIDC `sub`, display name,
-  seat, game-defined team label (nullable), whether they won, the points
+- `match_player` — one row per participant: the canonical provider-qualified
+  principal (`user_sub`), display name, seat, game-defined team label
+  (nullable), whether they won, the points
   they scored, the Elo change the match produced (`elo_delta`) and
   game-specific extras (`details` JSON). Unique per `(match, user_sub)`.
 - `player_rating` — current Elo rating and leaderboard totals per