Devserver and proxy configs for multi-realm

- devserver bootstraps via one-shot 'paskia init' when no database
  exists (multi --rp-id, --rp-name/--auth-host/--origin apply to the
  default realm), then runs plain 'paskia' serve which reads all realm
  configuration from the database; legacy *.paskiadb is adopted by
  serve without init.
- Caddy origins iterate all bootstrap rp-ids.
- vite.config.js accepts a comma-separated PASKIA_AUTH_HOST list and
  proxies /.well-known/webauthn to the backend so ROR works in dev.
- caddy/auth/setup forwards /.well-known/openid-configuration and
  /.well-known/webauthn to paskia (they must not be swallowed by a
  static /.well-known/* file handler); Caddyfile.dev updated to match
  the generated dev config.

caddy/Caddyfile.dev

@@ -1,9 +1,12 @@
 localhost {
-	# Forwards API by caddy, bypassing the Vite dev proxy
+	# WebSockets bypass directly to backend (workaround for bun proxy bug)
 	# Avoids bug https://github.com/oven-sh/bun/issues/9882
-	handle /api/* {
+	handle /auth/ws/* {
 		reverse_proxy :4402   # directly to backend
 	}
+	# Everything else goes to or via Vite
+	# (Vite proxies /auth/api, /.well-known/openid-configuration and
+	# /.well-known/webauthn to the backend)
 	handle {
 		reverse_proxy :4403   # vite dev server
 	}

caddy/auth/setup

@@ -4,3 +4,10 @@ header -Remote-*
 handle @auth_api {
     reverse_proxy {$AUTH_UPSTREAM::4401}
 }
+# Paskia-served well-known endpoints: OIDC discovery and WebAuthn Related
+# Origin Requests (must reach paskia even when other /.well-known/* files
+# are served statically)
+@auth_wellknown path /.well-known/openid-configuration /.well-known/webauthn
+handle @auth_wellknown {
+    reverse_proxy {$AUTH_UPSTREAM::4401}
+}