Rename realms to domains; object-keyed origins/related config format

Finish the realm→domain terminology removal across source, tests, e2e
and docs. The stored config drops all lists: Config.domains is keyed by
rp-id, DomainConfig.origins/related are objects keyed by host (https://
omitted), values True or OriginEntry(auth_host=True). The default/primary
domain concept is gone; ordering is display-time. Tests and e2e updated
to the new API shapes (not run). Database re-migrated from the legacy
backup into the new format.

tests/test_cli.py

@@ -1,9 +1,9 @@
 """Tests for the CLI entry point in paskia/__main__.py.
 
 The CLI is split into ``paskia init`` (create the combined paskia.kantadb
-with the initial realm(s)), ``paskia migrate`` (convert a legacy
+with the initial domain(s)), ``paskia migrate`` (convert a legacy
 ``<rp-id>.paskiadb`` database), and bare ``paskia`` (serve the stored
-realms; never migrates).
+domains; never migrates).
 """
 
 from __future__ import annotations
@@ -20,7 +20,7 @@ from kanta import Kanta
 
 from paskia.__main__ import _load_stored_config, main
 from paskia.db import legacy
-from paskia.db.structs import Config
+from paskia.db.structs import Config, OriginEntry
 from paskia.util.runtime import ServeConfig, clear_cache
 
 
@@ -85,9 +85,9 @@ def test_init_defaults(run_cli, tmp_path):
     run_cli("init")
 
     config = stored_config(tmp_path)
-    assert [r.rp_id for r in config.realms] == ["localhost"]
-    assert config.realms[0].rp_name is None
-    assert config.realms[0].auth_host is None
+    assert list(config.domains) == ["localhost"]
+    assert config.domains["localhost"].rp_name is None
+    assert config.domains["localhost"].origins == {}
     assert config.listen is None
 
 
@@ -107,11 +107,12 @@ def test_init_full_options(run_cli, tmp_path):
     )
 
     config = stored_config(tmp_path)
-    realm = config.realms[0]
-    assert realm.rp_id == "example.com"
-    assert realm.rp_name == "Example Corp"
-    assert realm.auth_host == "https://auth.example.com"
-    assert realm.origins == ["https://auth.example.com", "https://app.example.com"]
+    domain = config.domains["example.com"]
+    assert domain.rp_name == "Example Corp"
+    assert domain.origins == {
+        "app.example.com": True,
+        "auth.example.com": OriginEntry(auth_host=True),
+    }
     assert config.listen == ["4402"]
 
 
@@ -119,8 +120,7 @@ def test_init_multiple_rp_ids(run_cli, tmp_path):
     run_cli("init", "--rp-id", "company.com,app.com", "--rp-id", "pro.com")
 
     config = stored_config(tmp_path)
-    assert [r.rp_id for r in config.realms] == ["company.com", "app.com", "pro.com"]
-    assert config.default_realm.rp_id == "company.com"
+    assert list(config.domains) == ["company.com", "app.com", "pro.com"]
 
 
 def test_init_refuses_existing_database(run_cli):
@@ -184,8 +184,8 @@ def test_migrate_converts_legacy_database(run_cli, tmp_path):
     run_cli("migrate")
 
     config = stored_config(tmp_path)
-    assert [r.rp_id for r in config.realms] == ["example.com"]
-    assert config.realms[0].rp_name == "Legacy Name"
+    assert list(config.domains) == ["example.com"]
+    assert config.domains["example.com"].rp_name == "Legacy Name"
     # Legacy directory renamed aside, user files moved over
     assert not src_dir.exists()
     assert (tmp_path / "example.com.paskiadb.converted-bak").is_dir()
@@ -212,7 +212,7 @@ def test_migrate_explicit_rp_id_selects_candidate(run_cli, tmp_path):
     run_cli("migrate", "--rp-id", "two.com")
 
     config = stored_config(tmp_path)
-    assert [r.rp_id for r in config.realms] == ["two.com"]
+    assert list(config.domains) == ["two.com"]
     # The other candidate is left in place
     assert (tmp_path / "one.com.paskiadb").is_dir()
     assert (tmp_path / "two.com.paskiadb.converted-bak").is_dir()