Docs + e2e: single origins table, explicit-origins semantics

MultiSite.md/API.md/README: one allowed-origins list per domain where
out-of-domain entries are related origins; empty list allows nothing;
plain '*' rejected; new domains and legacy conversions seed '*.{rp-id}'.
E2E multidomain spec: new payload shape; restores return to the seeded
wildcard state.

docs/MultiSite.md

@@ -50,22 +50,23 @@ well.
 
 ## Allowed origins (sign-in sites)
 
-This list controls which sites may sign in with the domain's passkeys:
+This list controls which sites may sign in with the domain's passkeys.
+Everything is explicit: an empty list allows nothing of the domain itself
+(related origins, below, still work — a domain can in principle run
+entirely on related origins). A new domain starts with one entry,
+`*.{domain}`, which suits most deployments.
 
-- **Empty list (the default):** the domain and all its subdomains may
-  sign in, on any scheme. This suits most deployments; the domain dialog
-  shows the default as a `*` placeholder row.
-- **Once you add entries, the list becomes an allow-list** — only listed
-  sites may sign in:
-  - `app.company.com` — exactly this host, https only.
-  - `*.company.com` — the base domain and all its subdomains, https only.
-    Under `localhost`, wildcards match any scheme and any port, as a
-    development convenience.
-  - `http://localhost:8080` — a full origin with scheme, for non-https
-    exceptions.
-  - `*` — shorthand for `*.{domain}`: the whole domain over https.
+Entry forms:
 
-Entries must be inside the domain. An entry on a different domain name
+- `*.company.com` — the domain and all its subdomains, https only. Under
+  `localhost`, wildcards match any scheme and any port, as a development
+  convenience.
+- `app.company.com` — exactly this host, https only.
+- `http://localhost:8080` — a full origin with scheme, for non-https
+  exceptions.
+
+Wildcards must stay within the domain, and plain `*` is not accepted — it
+would suggest "anything goes". An entry on a different domain name
 automatically becomes a related origin (🔗) instead — see below.
 
 ## The auth host (🔑)
@@ -165,7 +166,9 @@ model:
   aside to `{domain}.paskiadb.converted-bak`. With several legacy
   databases, the positional argument selects one by name. Legacy wildcard
   origins convert as-is (https only, except any scheme and port under
-  `localhost`).
+  `localhost`); a legacy database without configured origins — where that
+  meant the whole domain was allowed — gets an explicit `*.{domain}`
+  entry.
 - Origins, auth hosts and related origins are no longer environment
   settings — they live in the database and are managed in the admin
   panel's Domains section. `PASKIA_AUTH_HOST` remains only as a