Add opentelemetry-api dependency and datasette/telemetry.py scaffolding

Datasette core is gaining OpenTelemetry spans alongside the existing
hand-rolled tracer. This commit only lays the groundwork - no span is
emitted yet.

Core takes a runtime dependency on opentelemetry-api and nothing more.
It deliberately never creates a TracerProvider, configures an exporter,
or touches sampling: that belongs to whoever runs Datasette, normally
via an opentelemetry-instrument agent. Owning a provider in core was
tried in an earlier design and produced a cross-request span leak, a
process-global provider that tests could not tear down, and a sampling
env var that silently blanked output. With no provider installed every
span is a NonRecordingSpan and costs approximately nothing.

datasette/telemetry.py exposes the module-level tracer plus
sql_attribute(), which truncates SQL to 2048 characters. On a public
instance the SQL is attacker-controlled and unbounded - someone can
paste a 10MB query into ?sql= - so it must never reach a telemetry
pipeline verbatim.

opentelemetry-sdk goes in the dev dependency group only, because the
test suite needs it to assert on spans while the package itself must
not import it. tests/test_telemetry.py enforces that by importing
datasette in a fresh interpreter and inspecting sys.modules, which
catches a lazy import inside a function body that a grep would miss.

conftest.py gains a session-scoped autouse fixture installing an SDK
provider with an InMemorySpanExporter. It has to be session-scoped
because set_tracer_provider() is effectively once-per-process - a
second call logs a warning and is ignored. SimpleSpanProcessor rather
than BatchSpanProcessor, so assertions made right after a request never
race a background export thread. The otel_spans fixture that later
tickets assert against is added here too.

test_datasette_package_never_imports_the_sdk is moved to the front of
the run. Late in a serial run the pytest process holds enough threads
that the fork half of subprocess' fork+exec segfaults the interpreter
on macOS/CPython 3.13. That reproduces with any subprocess call in that
position on an unmodified tree, so it is a pre-existing hazard rather
than something this commit introduces; the repo already moves its other
subprocess-spawning tests to the front for related reasons.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_telemetry.py

@@ -0,0 +1,25 @@
+import subprocess
+import sys
+
+
+def test_datasette_package_never_imports_the_sdk():
+    """
+    Core depends on opentelemetry-api only. The SDK is a test dependency.
+
+    Checked by importing datasette in a fresh process and inspecting
+    sys.modules, rather than by grepping, so a lazy `import
+    opentelemetry.sdk` inside a function body cannot slip past.
+
+    conftest.py's pytest_collection_modifyitems() moves this test to the
+    front of the run by name - if you rename it, rename it there too.
+    """
+    code = (
+        "import datasette.app, datasette.database, datasette.telemetry, sys; "
+        "print([m for m in sys.modules if m.startswith('opentelemetry.sdk')])"
+    )
+    result = subprocess.run(
+        [sys.executable, "-c", code], capture_output=True, text=True, check=True
+    )
+    assert (
+        result.stdout.strip() == "[]"
+    ), f"datasette imported the OpenTelemetry SDK: {result.stdout.strip()}"