Separate related domains (ROR) from the in-domain sign-in allow-list

RealmConfig.origins is again purely an allow-list of sign-in sites
within the realm's domain (unset = rp-id and all subdomains), restoring
the restriction semantics the realm rework had silently turned into an
always-open subtree. Cross-domain ROR origins move to their own
RealmConfig.related_origins field — always additive, capped, validated
to be outside the rp-id domain, and the sole source of the
/.well-known/webauthn document.

Admin API POST/PATCH accept related_origins; misfiled entries are
rejected (cross-domain in origins, in-domain in related_origins).

Admin UI: the realm dialog edits the two lists separately with
end-user-oriented explanations (allowed sign-in sites vs. related
domains + the well-known note); the Realms section intro explains the
multi-domain model, and the table shows sign-in site and related domain
counts.

e2e/tests/50-multirealm.spec.ts

@@ -79,7 +79,7 @@ test.describe('Multi-realm E2E', () => {
     // Add a related origin (unrelated domain) to the localhost realm
     const patch = await page.request.patch(`${baseUrl}/auth/api/admin/realms/localhost`, {
       headers,
-      data: { rp_name: '', auth_host: '', origins: ['https://app.example.com'] },
+      data: { rp_name: '', auth_host: '', origins: [], related_origins: ['https://app.example.com'] },
     })
     expect(patch.ok()).toBeTruthy()
 
@@ -89,10 +89,10 @@ test.describe('Multi-realm E2E', () => {
     const wkJson = await wk.json()
     expect(wkJson.origins).toContain('https://app.example.com')
 
-    // Restore: remove origins again so later tests see the pristine state
+    // Restore: remove related origins again so later tests see the pristine state
     const restore = await page.request.patch(`${baseUrl}/auth/api/admin/realms/localhost`, {
       headers,
-      data: { rp_name: '', auth_host: '', origins: [] },
+      data: { rp_name: '', auth_host: '', origins: [], related_origins: [] },
     })
     expect(restore.ok()).toBeTruthy()
     const after = await page.request.get(`${baseUrl}/.well-known/webauthn`)