Simplify paskia init to rp-id/rp-name only

Only rp-id and rp-name are essential bootstrap-time configuration;
origins and auth hosts are set up afterwards via the admin interface.
Removes --origin/--auth-host from init and from devserver, and the
now-unused hostutil.validate_auth_host.

docs/MultiSite.md

@@ -194,10 +194,10 @@ instance:
   - `--rp-id`: repeatable/comma-separated, default `["localhost"]`.
     Multiple values create multiple domains at once (useful for
     devserver/e2e).
-  - `--rp-name`, `--auth-host`, `--origin`: apply to the **first**
-    rp-id only. Their purpose is that the very first admin registration
-    ceremony already shows the correct RP name; everything is editable
-    via the admin interface afterwards.
+  - `--rp-name`: applies to the **first** rp-id only. Its purpose is that
+    the very first admin registration ceremony already shows the correct
+    RP name; everything else (origins, auth hosts, related domains) is
+    set up via the admin interface afterwards.
   - `--listen`: stored into `Config.listen` (process-global).
   - Seeds the admin user + registration reset link and prints the link.
     Refuses to run if `paskia.kantadb` already exists, or if an
@@ -466,10 +466,9 @@ effective_auth_host(domain) = domain's own auth host or first configured one or
 ## 12. Development
 
 - `scripts/devserver.py`: bootstraps via one-shot `paskia init` when no
-  database exists (multi `--rp-id`, and `--rp-name`/`--auth-host`/
-  `--origin` for the first domain), then runs plain `paskia` serve.
-  Caddy dev origins iterate all bootstrap rp-ids plus the auth host and
-  explicit origins.
+  database exists (multi `--rp-id`, `--rp-name` for the first domain),
+  then runs plain `paskia` serve. Caddy dev origins iterate all bootstrap
+  rp-ids.
 - `PASKIA_AUTH_HOST` (consumed by `frontend/vite.config.js`) is a
   comma-separated list of bare hostnames; the vite dev proxy forwards
   `/.well-known/openid-configuration` and `/.well-known/webauthn` to the