Separate related domains (ROR) from the in-domain sign-in allow-list

RealmConfig.origins is again purely an allow-list of sign-in sites
within the realm's domain (unset = rp-id and all subdomains), restoring
the restriction semantics the realm rework had silently turned into an
always-open subtree. Cross-domain ROR origins move to their own
RealmConfig.related_origins field — always additive, capped, validated
to be outside the rp-id domain, and the sole source of the
/.well-known/webauthn document.

Admin API POST/PATCH accept related_origins; misfiled entries are
rejected (cross-domain in origins, in-domain in related_origins).

Admin UI: the realm dialog edits the two lists separately with
end-user-oriented explanations (allowed sign-in sites vs. related
domains + the well-known note); the Realms section intro explains the
multi-domain model, and the table shows sign-in site and related domain
counts.

tests/test_admin.py

@@ -1928,7 +1928,8 @@ class TestRealms:
             json={
                 "rp_id": "example.com",
                 "rp_name": "Example",
-                "origins": ["https://app.example.com", "https://unrelated-site.com"],
+                "origins": ["https://app.example.com"],
+                "related_origins": ["https://unrelated-site.com"],
             },
             headers=headers,
         )
@@ -1983,13 +1984,35 @@ class TestRealms:
         # Related origin host may not collide across realms
         r = await client.post(
             "/auth/api/admin/realms/",
-            json={"rp_id": "example.com", "origins": ["https://shared-app.com"]},
+            json={
+                "rp_id": "example.com",
+                "related_origins": ["https://shared-app.com"],
+            },
             headers=headers,
         )
         assert r.status_code == 200
         r = await client.post(
             "/auth/api/admin/realms/",
-            json={"rp_id": "other.com", "origins": ["https://shared-app.com"]},
+            json={"rp_id": "other.com", "related_origins": ["https://shared-app.com"]},
+            headers=headers,
+        )
+        assert r.status_code == 400
+
+        # Cross-domain entries are rejected from the in-domain origins list
+        r = await client.post(
+            "/auth/api/admin/realms/",
+            json={"rp_id": "another.com", "origins": ["https://elsewhere.com"]},
+            headers=headers,
+        )
+        assert r.status_code == 400
+
+        # In-domain entries are rejected from the related origins list
+        r = await client.post(
+            "/auth/api/admin/realms/",
+            json={
+                "rp_id": "another.com",
+                "related_origins": ["https://app.another.com"],
+            },
             headers=headers,
         )
         assert r.status_code == 400