Simplify paskia init to rp-id/rp-name only

Only rp-id and rp-name are essential bootstrap-time configuration;
origins and auth hosts are set up afterwards via the admin interface.
Removes --origin/--auth-host from init and from devserver, and the
now-unused hostutil.validate_auth_host.

tests/test_cli.py

@@ -20,7 +20,7 @@ from kanta import Kanta
 
 from paskia.__main__ import _load_stored_config, main
 from paskia.db import legacy
-from paskia.db.structs import Config, OriginEntry
+from paskia.db.structs import Config
 from paskia.util.runtime import ServeConfig, clear_cache
 
 
@@ -98,10 +98,6 @@ def test_init_full_options(run_cli, tmp_path):
         "example.com",
         "--rp-name",
         "Example Corp",
-        "--auth-host",
-        "auth.example.com",
-        "--origin",
-        "https://app.example.com",
         "--listen",
         "4402",
     )
@@ -109,10 +105,7 @@ def test_init_full_options(run_cli, tmp_path):
     config = stored_config(tmp_path)
     domain = config.domains["example.com"]
     assert domain.rp_name == "Example Corp"
-    assert domain.origins == {
-        "app.example.com": True,
-        "auth.example.com": OriginEntry(auth_host=True),
-    }
+    assert domain.origins == {}
     assert config.listen == ["4402"]
 
 
@@ -135,9 +128,12 @@ def test_init_refuses_legacy_database(run_cli, tmp_path):
         run_cli("init")
 
 
-def test_init_invalid_auth_host(run_cli):
+def test_init_rejects_removed_options(run_cli):
+    """Origins and auth hosts are admin-interface configuration, not init's."""
     with pytest.raises(SystemExit):
-        run_cli("init", "--rp-id", "example.com", "--auth-host", "notsub.example.org")
+        run_cli("init", "--rp-id", "example.com", "--auth-host", "auth.example.com")
+    with pytest.raises(SystemExit):
+        run_cli("init", "--origin", "https://app.example.com")
 
 
 def test_serve_requires_database(run_cli):