Wildcard origins follow the shell-glob convention: **. for apex+any depth, *. for one level

'**.example.com' covers the apex and subdomains at any depth;
'*.example.com' covers exactly one subdomain level (neither apex nor
deeper) — analogous to permission scope wildcards, and sidestepping the
DNS/TLS/nginx ambiguity around '*.'. This also allows excluding the apex
where wanted. The seeded/default entry becomes '**.{rp-id}' (init,
add-domain, legacy empty-origins conversion, branch-era '*' sanitize
rewrite).

tests/test_admin.py

@@ -1828,7 +1828,7 @@ class TestDomains:
         assert len(data) == 1
         domain = data[0]
         assert domain["rp_id"] == "localhost"
-        assert domain["origins"] == {"*.localhost": True}
+        assert domain["origins"] == {"**.localhost": True}
         assert "related" not in domain
         assert domain["auth_host"] is None
         assert domain["site_url"] == "http://localhost:4401"
@@ -2022,7 +2022,7 @@ class TestDomains:
         )
         assert r.status_code == 200
 
-        # Plain '*' is rejected — wildcards must be explicit ('*.another.com')
+        # Plain '*' is rejected — wildcards must be explicit ('**.another.com')
         r = await client.post(
             "/auth/api/admin/domains/",
             json={"rp_id": "star.com", "origins": {"*": True}},