CLI: positional rp-id/rp-name; init adds domains to an existing database

- 'paskia init [rp-id] [rp-name]' and 'paskia migrate [rp-id]' are now
  positional; comma separation and the --rp-id/--rp-name flags are gone.
- With an existing paskia.kantadb, init adds the rp-id as a new domain
  (seeding its OIDC provider) or updates an existing domain's rp-name.
- Origin allow-list semantics clarified: the bare '*' entry allows
  anything within the rp-id domain on any scheme and port (also the
  empty-list default and its display in the admin UI, replacing the
  synthetic '*.rp-id' row); '*.x' wildcards are https-only; exact entries
  match scheme, host and port. Legacy '*.rp-id' wildcards migrate to '*'
  to preserve their any-scheme meaning.

scripts/devserver.py

@@ -162,16 +162,16 @@ def ensure_database(rp_ids: list[str], args: argparse.Namespace, listen: str) ->
             "convert it before starting the dev server."
         )
 
-    cmd = [sys.executable, "-m", "paskia", "init", f"--listen={listen}"]
-    for rp_id in rp_ids:
-        cmd.extend(["--rp-id", rp_id])
-    if args.rp_name:
-        cmd.extend(["--rp-name", args.rp_name])
-
-    logger.info(">>> paskia init (first run)")
-    proc = subprocess.run(cmd, check=False)  # noqa: S603
-    if proc.returncode != 0:
-        raise SystemExit(proc.returncode)
+    for i, rp_id in enumerate(rp_ids):
+        cmd = [sys.executable, "-m", "paskia", "init", rp_id]
+        if i == 0:
+            if args.rp_name:
+                cmd.append(args.rp_name)
+            cmd.append(f"--listen={listen}")
+        logger.info(">>> paskia init %s", rp_id)
+        proc = subprocess.run(cmd, check=False)  # noqa: S603
+        if proc.returncode != 0:
+            raise SystemExit(proc.returncode)
 
 
 async def run_devserver(args: argparse.Namespace, remaining: list[str]) -> None: