Wildcard origins follow the shell-glob convention: **. for apex+any depth, *. for one level

'**.example.com' covers the apex and subdomains at any depth;
'*.example.com' covers exactly one subdomain level (neither apex nor
deeper) — analogous to permission scope wildcards, and sidestepping the
DNS/TLS/nginx ambiguity around '*.'. This also allows excluding the apex
where wanted. The seeded/default entry becomes '**.{rp-id}' (init,
add-domain, legacy empty-origins conversion, branch-era '*' sanitize
rewrite).

tests/test_cli.py

@@ -87,7 +87,7 @@ def test_init_defaults(run_cli, tmp_path):
     config = stored_config(tmp_path)
     assert list(config.domains) == ["localhost"]
     assert config.domains["localhost"].rp_name is None
-    assert config.domains["localhost"].origins == {"*.localhost": True}
+    assert config.domains["localhost"].origins == {"**.localhost": True}
     assert config.listen is None
 
 
@@ -97,7 +97,7 @@ def test_init_full_options(run_cli, tmp_path):
     config = stored_config(tmp_path)
     domain = config.domains["example.com"]
     assert domain.rp_name == "Example Corp"
-    assert domain.origins == {"*.example.com": True}
+    assert domain.origins == {"**.example.com": True}
     assert config.listen == ["4402"]