Fix OIDC subject collisions by introducing canonical provider-plus-subject principals

- Add canonical_principal(provider, sub) => 'oidc:v1:<provider>:<sub>'
- Preserve provider identity across HTTP sessions and WebSockets
- Apply principals throughout: game creation/joining/seating, WebSocket views/actions,
  Redis engine state, match history, leaderboard focus, ratings, /api/me, OpenAPI,
  and telemetry
- Widen identity columns to 1024 chars with schema-only aerich migration (5_20261024221522_canonical_principals.py)
- Document provider names as stable security identifiers
- Add regression tests: same subject at different providers cannot share games, private hands,
  join codes, moves, history, or ratings; distinct seat and rating ownership verified
- All platform, integration, game, and frontend tests pass; mypy clean

server/tests/helpers/__init__.py

@@ -1,5 +1,5 @@
 """Test helpers package for the tavolo-app integration suite."""
 from .asynctest import async_test
-from .oidc import make_user, oidc_user, ws_users
+from .oidc import make_principal, make_user, oidc_user, ws_users
 
-__all__ = ["async_test", "make_user", "oidc_user", "ws_users"]
+__all__ = ["async_test", "make_principal", "make_user", "oidc_user", "ws_users"]

server/tests/helpers/oidc.py

@@ -17,6 +17,7 @@ from kaya.oidc import OIDCUser
 # ``tavolo.platform.auth`` themselves.
 from tavolo.app import oidc
 from tavolo.platform import auth
+from tavolo.platform.auth import AuthenticatedUser, canonical_principal
 
 # The app's first configured provider (the test environment configures one
 # named "default").
@@ -37,12 +38,17 @@ def make_user(
     return OIDCUser(claims)
 
 
+def make_principal(sub: str, provider: str = _PROVIDER) -> str:
+    return canonical_principal(provider, sub)
+
+
 @contextlib.contextmanager
 def oidc_user(
     sub: str,
     name: Optional[str] = None,
     email: Optional[str] = None,
     picture: Optional[str] = None,
+    provider: Optional[str] = None,
 ) -> Iterator[OIDCUser]:
     """Context manager: make ``oidc.get_users`` return this user.
 
@@ -52,7 +58,8 @@ def oidc_user(
     scope's avatar claim.
     """
     user = make_user(sub, name, email, picture)
-    patcher = _mock.patch.object(oidc, "get_users", return_value={_PROVIDER: user})
+    selected = provider or _PROVIDER
+    patcher = _mock.patch.object(oidc, "get_users", return_value={selected: user})
     patcher.start()
     try:
         yield user
@@ -65,7 +72,14 @@ def ws_users(users: Sequence[OIDCUser]) -> Iterator[None]:
     """Context manager: patch ``auth.get_ws_user`` to hand out ``users``
     one per websocket connection, in order. Once exhausted it keeps
     returning the last user."""
-    remaining = list(users)
+    remaining = [
+        AuthenticatedUser(
+            provider=_PROVIDER,
+            claims=user,
+            principal=canonical_principal(_PROVIDER, user.sub),
+        )
+        for user in users
+    ]
     last = remaining[-1] if remaining else None
 
     def _next(_ws):