CLI: positional rp-id/rp-name; init adds domains to an existing database

- 'paskia init [rp-id] [rp-name]' and 'paskia migrate [rp-id]' are now
  positional; comma separation and the --rp-id/--rp-name flags are gone.
- With an existing paskia.kantadb, init adds the rp-id as a new domain
  (seeding its OIDC provider) or updates an existing domain's rp-name.
- Origin allow-list semantics clarified: the bare '*' entry allows
  anything within the rp-id domain on any scheme and port (also the
  empty-list default and its display in the admin UI, replacing the
  synthetic '*.rp-id' row); '*.x' wildcards are https-only; exact entries
  match scheme, host and port. Legacy '*.rp-id' wildcards migrate to '*'
  to preserve their any-scheme meaning.

README.md

@@ -36,11 +36,11 @@ Paskia includes set of login, reauthentication and forbidden dialogs that it can
 Install [UV](https://docs.astral.sh/uv/getting-started/installation/) and run:
 
 ```sh
-uvx paskia init --rp-id example.com
+uvx paskia init example.com
 uvx paskia
 ```
 
-The first command bootstraps the database and prints a registration link for the Admin. The second starts the server on [localhost:4401](http://localhost:4401), serving authentication for `*.example.com`. For local testing, leave out `--rp-id` (defaults to `localhost`).
+The first command bootstraps the database and prints a registration link for the Admin. The second starts the server on [localhost:4401](http://localhost:4401), serving authentication for `*.example.com`. For local testing, leave out the rp-id (defaults to `localhost`).
 
 For production you need a web server such as [Caddy](https://caddyserver.com/) to serve HTTPS on your actual domain names and proxy requests to Paskia and your backend apps (see documentation below).
 
@@ -55,20 +55,21 @@ uv tool install paskia
 Bootstrapping is done once with `paskia init`; after that, `paskia` serves all configured domains from the database `paskia.kantadb` in the current directory. Domain configuration (rp-name, auth host, origins) is managed via the admin web interface, including adding further domains (rp-ids).
 
 ```text
-paskia init [options]    # one-time bootstrap
-paskia migrate [--rp-id] # convert a legacy {rp-id}.paskiadb database
-paskia [-l endpoint]     # serve
+paskia init [rp-id] [rp-name] [options]  # one-time bootstrap; with an existing
+                                         # database, adds the rp-id (or renames it)
+paskia migrate [rp-id]                   # convert a legacy {rp-id}.paskiadb database
+paskia [-l endpoint]                     # serve
 ```
 
 | init option | Description | Default |
 |--------|-------------|---------|
 | -l, --listen *endpoint* | Listen address: *host*:*port*, :*port* (all interfaces), or */path.sock* (stored in the database) | **localhost:4401** |
-| --rp-id *domain* | Main/top domain for passkeys. Repeatable and comma-separated for multiple domains | **localhost** |
-| --rp-name *"text"* | Branding name of the first domain (passkey auth, login dialog) | Same as rp-id |
+| *rp-id* (positional) | Main/top domain for passkeys | **localhost** |
+| *rp-name* (positional) | Branding name of the domain (passkey auth, login dialog) | Same as rp-id |
 
 Origins, auth hosts and related domains are configured afterwards in the admin panel's Domains section.
 
-The `paskia` serve command accepts only `--listen` (overriding the stored value) and never converts databases: with no `paskia.kantadb` it tells you to run `paskia init`, or `paskia migrate` when a legacy `{rp-id}.paskiadb` database is present. `paskia migrate` converts the legacy database; with several candidates, `--rp-id` selects one by name and the rest are left in place.
+The `paskia` serve command accepts only `--listen` (overriding the stored value) and never converts databases: with no `paskia.kantadb` it tells you to run `paskia init`, or `paskia migrate` when a legacy `{rp-id}.paskiadb` database is present. `paskia migrate` converts the legacy database; with several candidates, the positional rp-id selects one by name and the rest are left in place.
 
 ## Tutorial: From Local Testing to Production
 
@@ -79,11 +80,11 @@ This section walks you through a complete example, from running Paskia locally t
 For a real deployment, bootstrap Paskia with your domain name (rp-id). This enables SSO setup for that domain and any subdomains.
 
 ```sh
-uvx paskia init --rp-id=example.com --rp-name="Example Corp"
+uvx paskia init example.com "Example Corp"
 uvx paskia
 ```
 
-This binds passkeys to the rp-id, allowing them to be used there or on any subdomain of it. The `--rp-name` is the branding shown in UI and registered with passkeys for everything on your domain (rp id). Init prints a registration link—use it to create your Admin account. You may enter your real name here for a more suitable account name.
+This binds passkeys to the rp-id, allowing them to be used there or on any subdomain of it. The rp-name is the branding shown in UI and registered with passkeys for everything on your domain (rp id). Init prints a registration link—use it to create your Admin account. You may enter your real name here for a more suitable account name.
 
 ### Step 2: Set Up Caddy