Simplify paskia init to rp-id/rp-name only

Only rp-id and rp-name are essential bootstrap-time configuration;
origins and auth hosts are set up afterwards via the admin interface.
Removes --origin/--auth-host from init and from devserver, and the
now-unused hostutil.validate_auth_host.

docs/API.md

@@ -94,7 +94,7 @@ These are for internal use only, but are documented here because they are the co
 
 ### Auth host mode (dedicated auth site)
 
-A domain may configure a dedicated authentication host (auth-host, a subdomain of the rp-id), either at bootstrap (`paskia init --auth-host`) or via the Domains admin panel.
+A domain may configure a dedicated authentication host (auth-host, a subdomain of the rp-id) via the Domains admin panel.
 
 #### On the auth host:
 - The Web UI is served at site root instead of /auth/* (that redirects to root paths)

docs/MultiSite.md

@@ -194,10 +194,10 @@ instance:
   - `--rp-id`: repeatable/comma-separated, default `["localhost"]`.
     Multiple values create multiple domains at once (useful for
     devserver/e2e).
-  - `--rp-name`, `--auth-host`, `--origin`: apply to the **first**
-    rp-id only. Their purpose is that the very first admin registration
-    ceremony already shows the correct RP name; everything is editable
-    via the admin interface afterwards.
+  - `--rp-name`: applies to the **first** rp-id only. Its purpose is that
+    the very first admin registration ceremony already shows the correct
+    RP name; everything else (origins, auth hosts, related domains) is
+    set up via the admin interface afterwards.
   - `--listen`: stored into `Config.listen` (process-global).
   - Seeds the admin user + registration reset link and prints the link.
     Refuses to run if `paskia.kantadb` already exists, or if an
@@ -466,10 +466,9 @@ effective_auth_host(domain) = domain's own auth host or first configured one or
 ## 12. Development
 
 - `scripts/devserver.py`: bootstraps via one-shot `paskia init` when no
-  database exists (multi `--rp-id`, and `--rp-name`/`--auth-host`/
-  `--origin` for the first domain), then runs plain `paskia` serve.
-  Caddy dev origins iterate all bootstrap rp-ids plus the auth host and
-  explicit origins.
+  database exists (multi `--rp-id`, `--rp-name` for the first domain),
+  then runs plain `paskia` serve. Caddy dev origins iterate all bootstrap
+  rp-ids.
 - `PASKIA_AUTH_HOST` (consumed by `frontend/vite.config.js`) is a
   comma-separated list of bare hostnames; the vite dev proxy forwards
   `/.well-known/openid-configuration` and `/.well-known/webauthn` to the

docs/proxy/caddy.md

@@ -81,7 +81,7 @@ auth.example.com {
 }
 ```
 
-Remember to set the auth host for the domain — either `paskia init --auth-host auth.example.com` at bootstrap or in the admin panel's Domains section — to restrict the authentication services to this domain.
+Remember to set the auth host for the domain in the admin panel's Domains section to restrict the authentication services to this domain.
 
 Note that we still reserve `/auth/` on each site for logout page and any APIs your application may require, while full user profile and global options are only available on the auth host.
 

docs/proxy/traefik.md

@@ -92,7 +92,7 @@ authResponseHeaders:
 
 The `/auth/` router above forwards all authentication UI, API, and WebSocket traffic to Paskia. Because this router does **not** use the `paskia-auth` middleware, users can reach the login page and profile UI without being authenticated first. Traefik handles WebSocket upgrades automatically when the client requests them.
 
-If you are using a dedicated authentication host instead of `/auth/`, create a separate router for `auth.example.com` pointing to the Paskia service and set the domain's auth host (`paskia init --auth-host auth.example.com` at bootstrap, or the admin panel's Domains section).
+If you are using a dedicated authentication host instead of `/auth/`, create a separate router for `auth.example.com` pointing to the Paskia service and set the domain's auth host in the admin panel's Domains section.
 
 ## Adjusting requirements