Fix OIDC subject collisions by introducing canonical provider-plus-subject principals

- Add canonical_principal(provider, sub) => 'oidc:v1:<provider>:<sub>'
- Preserve provider identity across HTTP sessions and WebSockets
- Apply principals throughout: game creation/joining/seating, WebSocket views/actions,
  Redis engine state, match history, leaderboard focus, ratings, /api/me, OpenAPI,
  and telemetry
- Widen identity columns to 1024 chars with schema-only aerich migration (5_20261024221522_canonical_principals.py)
- Document provider names as stable security identifiers
- Add regression tests: same subject at different providers cannot share games, private hands,
  join codes, moves, history, or ratings; distinct seat and rating ownership verified
- All platform, integration, game, and frontend tests pass; mypy clean

server/tests/test_routes_games.py

@@ -6,7 +6,7 @@ import unittest
 from httpx import ASGITransport, AsyncClient
 
 from tavolo.app import app
-from tests.helpers import async_test, oidc_user
+from tests.helpers import async_test, make_principal, oidc_user
 
 
 class GamesRouteTest(unittest.TestCase):
@@ -37,7 +37,7 @@ class GamesRouteTest(unittest.TestCase):
             with oidc_user("alice"):
                 snapshot = await client.get(f"/api/games/{game_id}")
             self.assertEqual(200, snapshot.status_code)
-            self.assertEqual("alice", snapshot.json()["players"][0]["sub"])
+            self.assertEqual(make_principal("alice"), snapshot.json()["players"][0]["sub"])
 
             # A logged-in non-player is a read-only spectator: no join
             # code, and the view is marked as a spectator view.
@@ -98,6 +98,32 @@ class GamesRouteTest(unittest.TestCase):
                 self.assertEqual(0, participant["captured_count"])
                 self.assertEqual(0, participant["scope"])
 
+    @async_test
+    async def test_same_sub_other_provider_cannot_read_private_hand(self) -> None:
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            with oidc_user("alice"):
+                created = await client.post("/api/games", json={})
+            code = created.json()["join_code"]
+            game_id = created.json()["id"]
+            for player in ("bob", "carol", "dave"):
+                with oidc_user(player):
+                    await client.post("/api/games/join", json={"code": code})
+
+            with oidc_user("alice", provider="google"):
+                watched = await client.get(f"/api/games/{game_id}")
+            self.assertEqual(200, watched.status_code)
+            spectator = watched.json()
+            self.assertTrue(spectator["spectator"])
+            self.assertNotIn("join_code", spectator)
+            for participant in spectator["players"]:
+                self.assertNotIn("hand", participant)
+
+            with oidc_user("alice"):
+                owned = await client.get(f"/api/games/{game_id}")
+            self.assertFalse(owned.json()["spectator"])
+            self.assertIn("hand", owned.json()["players"][0])
+
     @async_test
     async def test_create_napola_option(self) -> None:
         transport = ASGITransport(app=app)
@@ -180,7 +206,7 @@ class GamesRouteTest(unittest.TestCase):
             self.assertFalse(body["napola"])
             self.assertTrue(body["asso_pigliatutto"])
             self.assertEqual(3, body["seats_open"])
-            self.assertEqual(["alice"], [p["sub"] for p in body["players"]])
+            self.assertEqual([make_principal("alice")], [p["sub"] for p in body["players"]])
 
             for player in ("bob", "carol", "dave"):
                 with oidc_user(player):