Rename realms to domains; object-keyed origins/related config format

Finish the realm→domain terminology removal across source, tests, e2e
and docs. The stored config drops all lists: Config.domains is keyed by
rp-id, DomainConfig.origins/related are objects keyed by host (https://
omitted), values True or OriginEntry(auth_host=True). The default/primary
domain concept is gone; ordering is display-time. Tests and e2e updated
to the new API shapes (not run). Database re-migrated from the legacy
backup into the new format.

tests/test_api.py

@@ -18,10 +18,10 @@ from uuid import UUID
 import httpx
 import pytest
 
-from paskia import authcode, db, realms
+from paskia import authcode, db, domains
 from paskia.authsession import EXPIRES
 from paskia.db import delete_session
-from paskia.db.structs import Client, Config, RealmConfig
+from paskia.db.structs import Client, Config, DomainConfig, OriginEntry
 from paskia.fastapi.api import _REFRESH_INTERVAL
 from paskia.util import avatar, oidjwt, permutil
 from paskia.util.crypto import hash_secret
@@ -69,9 +69,15 @@ class TestAvatarUrls:
         self, tmp_path, monkeypatch
     ):
         """Absolute avatar URLs should preserve /auth/api even with an auth host."""
-        realms.configure(listen=None)
-        realms.init_registry(
-            Config(realms=[RealmConfig(rp_id="zi.fi", auth_host="https://auth.zi.fi")])
+        domains.configure(listen=None)
+        domains.init_registry(
+            Config(
+                domains={
+                    "zi.fi": DomainConfig(
+                        origins={"auth.zi.fi": OriginEntry(auth_host=True)}
+                    )
+                }
+            )
         )
 
         # The autouse avatar fixture redirects storage to tmp_path / "users"