CLI: positional rp-id/rp-name; init adds domains to an existing database

- 'paskia init [rp-id] [rp-name]' and 'paskia migrate [rp-id]' are now
  positional; comma separation and the --rp-id/--rp-name flags are gone.
- With an existing paskia.kantadb, init adds the rp-id as a new domain
  (seeding its OIDC provider) or updates an existing domain's rp-name.
- Origin allow-list semantics clarified: the bare '*' entry allows
  anything within the rp-id domain on any scheme and port (also the
  empty-list default and its display in the admin UI, replacing the
  synthetic '*.rp-id' row); '*.x' wildcards are https-only; exact entries
  match scheme, host and port. Legacy '*.rp-id' wildcards migrate to '*'
  to preserve their any-scheme meaning.

frontend/auth/admin/AdminApp.vue

@@ -490,7 +490,7 @@ function createDomain() {
 function openDomain(domain) {
   // One combined list for editing, in display order: in-domain sites and
   // related origins, classified by hostname. The default is always shown
-  // explicitly as the '*.rp_id' wildcard entry.
+  // explicitly as the '*' entry.
   const rows = originDisplayEntries(domain)
   openDialog('domain-edit', {
     isNew: false,
@@ -951,6 +951,10 @@ async function submitDialog() {
       const related = {}
       for (const o of (d.origins || []).map(o => o.trim()).filter(o => o)) {
         const key = keyOf(o)
+        if (key === '*') {
+          origins['*'] = true // anything in-domain, any scheme/port
+          continue
+        }
         let hn = null
         if (key.startsWith('*.')) {
           hn = key.slice(2).replace(/\.+$/, '')