Tests: align with instance-global OIDC and per-domain auth hosts

- '*' origin is wildcard shorthand (https-only outside localhost)
- related origins may fall inside another domain's rp-id; the listing
  wins dispatch, an exact rp-id always wins
- shared auth hosts resolve best-suffix; no cross-domain fallback
- OIDC codes are host-independent; log censoring path is oidc.key
- legacy wildcards convert as-is; legacy OIDC carries over as-is

tests/test_admin.py

@@ -1830,7 +1830,7 @@ class TestDomains:
         assert domain["rp_id"] == "localhost"
         assert domain["origins"] == {}
         assert domain["related"] == {}
-        assert domain["effective_auth_host"] is None
+        assert domain["auth_host"] is None
         assert domain["site_url"] == "http://localhost:4401"
 
     @pytest.mark.asyncio
@@ -1945,9 +1945,6 @@ class TestDomains:
         assert created["rp_name"] == "Example"
         assert created["related"] == {"unrelated-site.com": True}
 
-        # OIDC provider seeded for the new domain
-        assert db.data().oidc_for("example.com") is not None
-
         r = await client.delete("/auth/api/admin/domains/example.com", headers=headers)
         assert r.status_code == 200, r.text
         assert "example.com" not in db.data().config.domains
@@ -2102,14 +2099,15 @@ class TestDomains:
         assert r.status_code == 200, r.text
 
     @pytest.mark.asyncio
-    async def test_effective_auth_host_fallback(
+    async def test_no_cross_domain_auth_host_fallback(
         self,
         client: httpx.AsyncClient,
         session_token: str,
         test_user,
         test_credential,
     ):
-        """A domain without its own auth host uses the shared one in settings."""
+        """A domain without its own auth host reports none — there is no
+        cross-domain fallback to another domain's auth host."""
         headers = await self._set_auth_host(
             client, session_token, test_user, test_credential
         )
@@ -2118,9 +2116,15 @@ class TestDomains:
         )
         assert r.status_code == 200
 
-        # Settings on the example.com host report the shared effective auth host
+        # Settings on the example.com host report no auth host
         r = await client.get("/auth/api/settings", headers={"Host": "example.com"})
         assert r.status_code == 200
         assert r.json()["rp_id"] == "example.com"
-        assert r.json()["auth_host"] == "auth.localhost"
+        assert r.json()["auth_host"] is None
         assert r.json()["own_auth_host"] is None
+
+        # The localhost domain still reports its own auth host
+        r = await client.get("/auth/api/settings", headers={"Host": "auth.localhost"})
+        assert r.status_code == 200
+        assert r.json()["auth_host"] == "auth.localhost"
+        assert r.json()["own_auth_host"] == "auth.localhost"