Single origins table per domain; explicit origins semantics

DomainConfig.related is gone: origins holds both in-domain sign-in sites
and related origins, classified by whether the entry lies within the
rp-id. Misfiling is impossible by construction, so validation/sanitize
lose their reclassification paths.

Origins are now always explicit: an empty table allows nothing (a
related-only domain is a valid configuration). Plain '*' is rejected —
wildcards must be under the rp-id ('*.{rp-id}'). New databases, added
domains and legacy conversions seed '*.{rp-id}' (legacy empty origins
meant allow-all). Passkey's implicit allow-all default is gone; the
admin API takes a single origins map and the lockout guard refuses
emptying the table on the domain in use.

tests/test_cli.py

@@ -87,7 +87,7 @@ def test_init_defaults(run_cli, tmp_path):
     config = stored_config(tmp_path)
     assert list(config.domains) == ["localhost"]
     assert config.domains["localhost"].rp_name is None
-    assert config.domains["localhost"].origins == {}
+    assert config.domains["localhost"].origins == {"*.localhost": True}
     assert config.listen is None
 
 
@@ -97,7 +97,7 @@ def test_init_full_options(run_cli, tmp_path):
     config = stored_config(tmp_path)
     domain = config.domains["example.com"]
     assert domain.rp_name == "Example Corp"
-    assert domain.origins == {}
+    assert domain.origins == {"*.example.com": True}
     assert config.listen == ["4402"]