Single origins table per domain; explicit origins semantics

DomainConfig.related is gone: origins holds both in-domain sign-in sites
and related origins, classified by whether the entry lies within the
rp-id. Misfiling is impossible by construction, so validation/sanitize
lose their reclassification paths.

Origins are now always explicit: an empty table allows nothing (a
related-only domain is a valid configuration). Plain '*' is rejected —
wildcards must be under the rp-id ('*.{rp-id}'). New databases, added
domains and legacy conversions seed '*.{rp-id}' (legacy empty origins
meant allow-all). Passkey's implicit allow-all default is gone; the
admin API takes a single origins map and the lockout guard refuses
emptying the table on the domain in use.

tests/test_admin.py

@@ -1828,8 +1828,8 @@ class TestDomains:
         assert len(data) == 1
         domain = data[0]
         assert domain["rp_id"] == "localhost"
-        assert domain["origins"] == {}
-        assert domain["related"] == {}
+        assert domain["origins"] == {"*.localhost": True}
+        assert "related" not in domain
         assert domain["auth_host"] is None
         assert domain["site_url"] == "http://localhost:4401"
 
@@ -1900,26 +1900,39 @@ class TestDomains:
         self,
         client: httpx.AsyncClient,
         session_token: str,
-        test_user,
-        test_credential,
     ):
-        """With no origins left, site_url must not keep the removed auth host."""
-        headers = await self._set_auth_host(
-            client, session_token, test_user, test_credential
+        """Emptying a domain's origins table must not keep the removed auth
+        host in derived URLs. Only possible on a domain other than the one
+        in use — the lockout guard refuses it there."""
+        headers = {**auth_headers(session_token), "Host": "localhost:4401"}
+        r = await client.post(
+            "/auth/api/admin/domains/",
+            json={
+                "rp_id": "example.com",
+                "origins": {
+                    "auth.example.com": {"auth_host": True},
+                    "app.example.com": True,
+                },
+            },
+            headers=headers,
         )
+        assert r.status_code == 200, r.text
+        domain = domains.registry().get("example.com")
+        assert domain.own_auth_host == "auth.example.com"
+        assert "auth.example.com" in domain.site_url
 
         r = await client.patch(
-            "/auth/api/admin/domains/localhost",
+            "/auth/api/admin/domains/example.com",
             json={"rp_name": "", "origins": {}},
             headers=headers,
         )
         assert r.status_code == 200, r.text
 
-        domain = domains.registry().get("localhost")
+        domain = domains.registry().get("example.com")
         assert domain.own_auth_host is None
         assert domain.ui_base_path == "/auth/"
-        assert "auth.localhost" not in domain.site_url
-        assert "auth.localhost" not in domain.auth_site_url
+        assert "auth.example.com" not in domain.site_url
+        assert "auth.example.com" not in domain.auth_site_url
 
     @pytest.mark.asyncio
     async def test_create_and_delete_domain(
@@ -1931,8 +1944,7 @@ class TestDomains:
             json={
                 "rp_id": "example.com",
                 "rp_name": "Example",
-                "origins": {"app.example.com": True},
-                "related": {"unrelated-site.com": True},
+                "origins": {"app.example.com": True, "unrelated-site.com": True},
             },
             headers=headers,
         )
@@ -1943,7 +1955,12 @@ class TestDomains:
         assert set(domains_list) == {"localhost", "example.com"}
         created = domains_list["example.com"]
         assert created["rp_name"] == "Example"
-        assert created["related"] == {"unrelated-site.com": True}
+        # In-domain and related origins live in one table; classification
+        # is derived from the rp-id
+        assert created["origins"] == {
+            "app.example.com": True,
+            "unrelated-site.com": True,
+        }
 
         r = await client.delete("/auth/api/admin/domains/example.com", headers=headers)
         assert r.status_code == 200, r.text
@@ -1986,29 +2003,29 @@ class TestDomains:
         # Related origin host may not collide across domains
         r = await client.post(
             "/auth/api/admin/domains/",
-            json={"rp_id": "example.com", "related": {"shared-app.com": True}},
+            json={"rp_id": "example.com", "origins": {"shared-app.com": True}},
             headers=headers,
         )
         assert r.status_code == 200
         r = await client.post(
             "/auth/api/admin/domains/",
-            json={"rp_id": "other.com", "related": {"shared-app.com": True}},
+            json={"rp_id": "other.com", "origins": {"shared-app.com": True}},
             headers=headers,
         )
         assert r.status_code == 400
 
-        # Cross-domain entries are rejected from the in-domain origins list
+        # Cross-domain entries are related origins — accepted in the same table
         r = await client.post(
             "/auth/api/admin/domains/",
             json={"rp_id": "another.com", "origins": {"elsewhere.com": True}},
             headers=headers,
         )
-        assert r.status_code == 400
+        assert r.status_code == 200
 
-        # In-domain entries are rejected from the related origins list
+        # Plain '*' is rejected — wildcards must be explicit ('*.another.com')
         r = await client.post(
             "/auth/api/admin/domains/",
-            json={"rp_id": "another.com", "related": {"app.another.com": True}},
+            json={"rp_id": "star.com", "origins": {"*": True}},
             headers=headers,
         )
         assert r.status_code == 400
@@ -2060,6 +2077,15 @@ class TestDomains:
         assert r.status_code == 400
         assert "lock you out" in r.text
 
+        # Emptying the origins table entirely is likewise a lockout
+        r = await client.patch(
+            "/auth/api/admin/domains/localhost",
+            json={"rp_name": "", "origins": {}},
+            headers=headers,
+        )
+        assert r.status_code == 400
+        assert "lock you out" in r.text
+
         # Allow-list including the current host is fine
         r = await client.patch(
             "/auth/api/admin/domains/localhost",