MultiSite: one instance serves authentication across many domains (#4)

- Serve multiple domains (RP IDs) from one instance: host-based dispatch,
  per-domain credentials and sessions, domains managed at runtime in the
  admin UI — previously one RP per instance
- Cross-domain sign-in via Related Origin Requests: per-domain related-origins
  list with a served .well-known/webauthn document
- Explicit per-domain origin lists with shell-glob wildcards (**. for apex +
  any subdomain depth, *. for one level), editable in the admin UI with
  validation and self-lockout guards
- Per-domain auth hosts: the account/admin UI can live on a different host
  per domain, no longer confined to subdomains of a single RP
- CLI: 'paskia init <rp-id [rp-name]' initializes or adds a domain to an
  existing database; 'paskia migrate' converts legacy databases

BREAKING CHANGES (v2.0):
- Database schema: config is now per-domain and credentials/sessions carry
  an rp_id — existing databases must be converted with 'paskia migrate'
- Origins are now explicit: main implicitly allowed every subdomain of the
  RP; configure '**.' origins to reproduce that behavior
- CLI: the flat '--rp-id/--rp-name/--origin/--auth/--save' flags are
  replaced by the 'init' and 'migrate' subcommandsReviewed-on: #4

tests/test_user.py

@@ -15,7 +15,6 @@ from urllib.parse import urlsplit
 import httpx
 import pytest
 
-from paskia.db.paths import db_file_path, users_root_path
 from tests.conftest import auth_headers, create_test_image_bytes
 
 
@@ -93,8 +92,6 @@ class TestUserAvatar:
         monkeypatch,
     ):
         """Uploading a WebP avatar should store and expose the canonical URL."""
-        monkeypatch.setenv("PASKIA_DB", str(tmp_path / "test-avatar-db.paskiadb"))
-
         upload_bytes = create_test_image_bytes()
 
         response = await client.put(
@@ -138,8 +135,6 @@ class TestUserAvatar:
         monkeypatch,
     ):
         """Avatar uploads must already be browser-prepared WebP."""
-        monkeypatch.setenv("PASKIA_DB", str(tmp_path / "test-avatar-db.paskiadb"))
-
         response = await client.put(
             f"/auth/api/user/{test_user.uuid}/profile.webp",
             files={
@@ -165,8 +160,6 @@ class TestUserAvatar:
         monkeypatch,
     ):
         """Deleting avatar should clear the user avatar URL."""
-        monkeypatch.setenv("PASKIA_DB", str(tmp_path / "test-avatar-db.paskiadb"))
-
         await client.put(
             f"/auth/api/user/{test_user.uuid}/profile.webp",
             files={"file": ("avatar.webp", create_test_image_bytes(), "image/webp")},
@@ -203,30 +196,6 @@ class TestUserAvatar:
         assert response.status_code == 403
 
 
-def test_paskia_db_legacy_file_is_migrated_to_root_dir(tmp_path, monkeypatch):
-    legacy_path = tmp_path / "legacy.paskiadb"
-    legacy_bytes = b'{"v":0}\n'
-    legacy_path.write_bytes(legacy_bytes)
-
-    monkeypatch.setenv("PASKIA_DB", str(legacy_path))
-
-    db_path = db_file_path(create_root=True)
-
-    assert legacy_path.is_dir()
-    assert db_path == legacy_path / "main.db"
-    assert db_path.read_bytes() == legacy_bytes
-
-
-def test_paskia_db_root_uses_users_directory(tmp_path, monkeypatch):
-    root_path = tmp_path / "instance-root"
-    monkeypatch.setenv("PASKIA_DB", str(root_path))
-
-    users_path = users_root_path(create_root=True)
-
-    assert users_path == root_path / "users"
-    assert users_path.parent == root_path
-
-
 class TestUserLogoutAll:
     """Tests for POST /auth/api/user/logout-all"""