Tests: align with instance-global OIDC and per-domain auth hosts

- '*' origin is wildcard shorthand (https-only outside localhost)
- related origins may fall inside another domain's rp-id; the listing
  wins dispatch, an exact rp-id always wins
- shared auth hosts resolve best-suffix; no cross-domain fallback
- OIDC codes are host-independent; log censoring path is oidc.key
- legacy wildcards convert as-is; legacy OIDC carries over as-is

tests/test_cli.py

@@ -110,17 +110,22 @@ def test_init_adds_domains_to_existing_database(run_cli, tmp_path):
     config = stored_config(tmp_path)
     assert list(config.domains) == ["company.com", "app.com", "pro.com"]
     assert config.domains["pro.com"].rp_name == "Pro Corp"
-    # OIDC providers seeded for the added domains
-    assert set(converted_oidc(tmp_path)) == {"company.com", "app.com", "pro.com"}
 
 
-def converted_oidc(tmp_path):
+def test_init_seeds_one_global_oidc_key(run_cli, tmp_path):
+    """OIDC is instance-global: init seeds a single signing key."""
+    run_cli("init", "company.com")
+    run_cli("init", "app.com")
+    assert converted_oidc_key(tmp_path) is not None
+
+
+def converted_oidc_key(tmp_path):
     async def _read():
         new_db = DB()
         kanta = Kanta(str(tmp_path / "paskia.kantadb"), new_db)
         await kanta.open(readonly=True)
         try:
-            return set(kanta.data.oidc)
+            return kanta.data.oidc.key
         finally:
             await kanta.close()