CLI: positional rp-id/rp-name; init adds domains to an existing database

- 'paskia init [rp-id] [rp-name]' and 'paskia migrate [rp-id]' are now
  positional; comma separation and the --rp-id/--rp-name flags are gone.
- With an existing paskia.kantadb, init adds the rp-id as a new domain
  (seeding its OIDC provider) or updates an existing domain's rp-name.
- Origin allow-list semantics clarified: the bare '*' entry allows
  anything within the rp-id domain on any scheme and port (also the
  empty-list default and its display in the admin UI, replacing the
  synthetic '*.rp-id' row); '*.x' wildcards are https-only; exact entries
  match scheme, host and port. Legacy '*.rp-id' wildcards migrate to '*'
  to preserve their any-scheme meaning.

e2e/tests/global-setup.ts

@@ -44,14 +44,13 @@ export default async function globalSetup() {
 
   const state: TestState = {}
 
-  // Bootstrap the database: two domains, localhost (default) and test.localhost
+  // Bootstrap the database: two domains, localhost and test.localhost
   console.log('  Bootstrapping database with paskia init...')
   const initResult = spawnSync(
     'uv',
     [
       'run', '--project', projectRoot,
-      'paskia', 'init', '-l', 'localhost:4404',
-      '--rp-id', 'localhost,test.localhost',
+      'paskia', 'init', '-l', 'localhost:4404', 'localhost',
     ],
     { cwd: testDataDir, encoding: 'utf-8' }
   )
@@ -60,6 +59,15 @@ export default async function globalSetup() {
   if (initResult.status !== 0) {
     throw new Error(`paskia init failed with exit code ${initResult.status}`)
   }
+  const addResult = spawnSync(
+    'uv',
+    ['run', '--project', projectRoot, 'paskia', 'init', 'test.localhost'],
+    { cwd: testDataDir, encoding: 'utf-8' }
+  )
+  process.stdout.write(`${addResult.stdout}${addResult.stderr}`)
+  if (addResult.status !== 0) {
+    throw new Error(`paskia init test.localhost failed with exit code ${addResult.status}`)
+  }
 
   // Parse the reset token from init output
   // Format: http://localhost:4404/auth/{token} where token is dot-separated words