Devserver and proxy configs for multi-realm

- devserver bootstraps via one-shot 'paskia init' when no database
  exists (multi --rp-id, --rp-name/--auth-host/--origin apply to the
  default realm), then runs plain 'paskia' serve which reads all realm
  configuration from the database; legacy *.paskiadb is adopted by
  serve without init.
- Caddy origins iterate all bootstrap rp-ids.
- vite.config.js accepts a comma-separated PASKIA_AUTH_HOST list and
  proxies /.well-known/webauthn to the backend so ROR works in dev.
- caddy/auth/setup forwards /.well-known/openid-configuration and
  /.well-known/webauthn to paskia (they must not be swallowed by a
  static /.well-known/* file handler); Caddyfile.dev updated to match
  the generated dev config.

scripts/devserver.py

@@ -6,6 +6,7 @@ import asyncio
 import json
 import os
 import shutil
+import subprocess
 import sys
 from contextlib import suppress
 from pathlib import Path
@@ -13,6 +14,9 @@ from urllib.parse import urlparse
 
 import tracerite
 
+from paskia.db.legacy import find_legacy_databases
+from paskia.db.paths import db_file_path
+
 # Import utilities from scripts/fastapi-vue (not a package, so we adjust sys.path)
 sys.path.insert(0, str(Path(__file__).with_name("fastapi-vue")))
 from devutil import (  # noqa: E402
@@ -135,6 +139,40 @@ async def run_caddy(
     return proc
 
 
+def _split_multi(values: list[str] | None) -> list[str]:
+    """Split repeatable/comma-separated CLI values into a flat list."""
+    result = []
+    for value in values or []:
+        result.extend(part.strip() for part in value.split(",") if part.strip())
+    return result
+
+
+def ensure_database(rp_ids: list[str], args: argparse.Namespace, listen: str) -> None:
+    """Bootstrap paskia.kantadb via 'paskia init' when no database exists.
+
+    Realm options are init-only; 'paskia' (serve) reads all configuration
+    from the database. A legacy *.paskiadb database is adopted by serve,
+    so no init is run in that case either.
+    """
+    if db_file_path().exists() or find_legacy_databases():
+        return
+
+    cmd = [sys.executable, "-m", "paskia", "init", f"--listen={listen}"]
+    for rp_id in rp_ids:
+        cmd.extend(["--rp-id", rp_id])
+    if args.rp_name:
+        cmd.extend(["--rp-name", args.rp_name])
+    if args.auth_host:
+        cmd.extend(["--auth-host", args.auth_host])
+    for origin in _split_multi(args.origins):
+        cmd.extend(["--origin", origin])
+
+    logger.info(">>> paskia init (first run)")
+    proc = subprocess.run(cmd, check=False)  # noqa: S603
+    if proc.returncode != 0:
+        raise SystemExit(proc.returncode)
+
+
 async def run_devserver(args: argparse.Namespace, remaining: list[str]) -> None:
     """Run the development server with all components."""
     reporoot = Path(__file__).parent.parent
@@ -146,13 +184,10 @@ async def run_devserver(args: argparse.Namespace, remaining: list[str]) -> None:
     viteurl, npm_install, vite = setup_vite(args.listen, DEFAULT_VITE_PORT)
     backurl, paskia = setup_cli("paskia", args.backend, DEFAULT_DEV_PORT)
 
-    # Build paskia command with options
-    paskia.extend(["--rp-id", args.rp_id])
-    if args.auth_host:
-        paskia.extend(["--auth-host", args.auth_host])
-    if args.origins:
-        for origin in args.origins:
-            paskia.extend(["--origin", origin])
+    rp_ids = _split_multi(args.rp_id) or ["localhost"]
+    ensure_database(rp_ids, args, listen=backurl.removeprefix("http://"))
+
+    # Serve: no realm options — all configuration lives in the database
     paskia.extend(remaining)
 
     # Set environment for subprocesses
@@ -171,14 +206,12 @@ async def run_devserver(args: argparse.Namespace, remaining: list[str]) -> None:
                 if "://" not in auth_host:
                     auth_host = f"https://{auth_host}"
                 caddy_origins.append(auth_host)
-                caddy_origins.append(f"https://{args.rp_id}")
-            if args.origins:
-                for origin in args.origins:
-                    if "://" not in origin:
-                        origin = f"https://{origin}"
-                    caddy_origins.append(origin)
-            if not caddy_origins:
-                caddy_origins.append(f"https://{args.rp_id}")
+            for rp_id in rp_ids:
+                caddy_origins.append(f"https://{rp_id}")
+            for origin in _split_multi(args.origins):
+                if "://" not in origin:
+                    origin = f"https://{origin}"
+                caddy_origins.append(origin)
             seen: set = set()
             caddy_origins = [x for x in caddy_origins if not (x in seen or seen.add(x))]
             caddy_proc = await run_caddy(caddy_origins, viteurl, backurl)
@@ -209,11 +242,22 @@ def main():
         help=f"FastAPI (default: localhost:{DEFAULT_DEV_PORT})",
     )
     parser.add_argument("--caddy", action="store_true", help="Run Caddy as HTTPS proxy")
-    parser.add_argument("--rp-id", default="localhost", help="Relying Party ID")
     parser.add_argument(
-        "--origin", action="append", dest="origins", help="Allowed origin(s)"
+        "--rp-id",
+        action="append",
+        help="Relying Party ID(s) for first-run bootstrap (default: localhost). "
+        "Repeatable and comma-separated; the first is the default realm.",
     )
-    parser.add_argument("--auth-host", help="Dedicated auth host")
+    parser.add_argument(
+        "--rp-name", help="Relying Party name of the default realm (bootstrap only)"
+    )
+    parser.add_argument(
+        "--origin",
+        action="append",
+        dest="origins",
+        help="Allowed origin(s), bootstrap only",
+    )
+    parser.add_argument("--auth-host", help="Dedicated auth host for the default realm")
     args, remaining = parser.parse_known_args()
 
     with suppress(KeyboardInterrupt):