Rename realms to domains; object-keyed origins/related config format

Finish the realm→domain terminology removal across source, tests, e2e
and docs. The stored config drops all lists: Config.domains is keyed by
rp-id, DomainConfig.origins/related are objects keyed by host (https://
omitted), values True or OriginEntry(auth_host=True). The default/primary
domain concept is gone; ordering is display-time. Tests and e2e updated
to the new API shapes (not run). Database re-migrated from the legacy
backup into the new format.

scripts/devserver.py

@@ -150,7 +150,7 @@ def _split_multi(values: list[str] | None) -> list[str]:
 def ensure_database(rp_ids: list[str], args: argparse.Namespace, listen: str) -> None:
     """Bootstrap paskia.kantadb via 'paskia init' when no database exists.
 
-    Realm options are init-only; 'paskia' (serve) reads all configuration
+    Domain options are init-only; 'paskia' (serve) reads all configuration
     from the database. A legacy *.paskiadb database must be converted with
     'paskia migrate' first.
     """
@@ -192,7 +192,7 @@ async def run_devserver(args: argparse.Namespace, remaining: list[str]) -> None:
     rp_ids = _split_multi(args.rp_id) or ["localhost"]
     ensure_database(rp_ids, args, listen=backurl.removeprefix("http://"))
 
-    # Serve: no realm options — all configuration lives in the database
+    # Serve: no domain options — all configuration lives in the database
     paskia.extend(remaining)
 
     # Set environment for subprocesses
@@ -251,10 +251,10 @@ def main():
         "--rp-id",
         action="append",
         help="Relying Party ID(s) for first-run bootstrap (default: localhost). "
-        "Repeatable and comma-separated; the first is the default realm.",
+        "Repeatable and comma-separated; the bootstrap name/host options apply to the first.",
     )
     parser.add_argument(
-        "--rp-name", help="Relying Party name of the default realm (bootstrap only)"
+        "--rp-name", help="Relying Party name of the first domain (bootstrap only)"
     )
     parser.add_argument(
         "--origin",
@@ -262,7 +262,9 @@ def main():
         dest="origins",
         help="Allowed origin(s), bootstrap only",
     )
-    parser.add_argument("--auth-host", help="Dedicated auth host for the default realm")
+    parser.add_argument(
+        "--auth-host", help="Dedicated auth host for the first domain (bootstrap only)"
+    )
     args, remaining = parser.parse_known_args()
 
     with suppress(KeyboardInterrupt):