Realm dispatch, per-realm OIDC, realm-scoped credentials and admin realm API

- DispatchMiddleware (outermost app middleware) resolves Host to a realm:
  HTTP 421 for unknown hosts, WS closed pre-accept (1008); cross-realm WS
  only via the origin realm's effective auth host. Current realm exposed
  via request.state.realm and the current_realm() contextvar.
- Credentials and sessions are scoped by realm rp_id: authentication only
  matches credentials of the dispatched realm; sessions record rp_id.
- Auth codes (OIDC and cookie exchange) are stamped with the issuing
  realm and verified at redemption; remote-auth permits mint the exchange
  code for the *requesting* device's realm.
- OIDC provider state (clients, signing keys) is per realm; token,
  userinfo, keys and backchannel-logout endpoints use the dispatched
  realm; refresh re-stamps the session issuer.
- /.well-known/webauthn serves the realm's related origins (ROR).
- Admin /server-config replaced by /realms CRUD (validated cross-realm,
  registry rebuilt on change); permission domains may reference any
  realm's hosts or clients; /settings reports the realm's own vs
  effective auth host.
- paskia.globals and the runtime-backed hostutil helpers are gone.

paskia/authcode.py

@@ -24,21 +24,31 @@ class OIDCCode(msgspec.Struct):
     """An OIDC authorization code pending token exchange.
 
     PKCE uses S256 only when provided (verified at token exchange).
+    rp_id binds the code to the realm it was issued in; the token
+    endpoint (dispatched by Host) must match.
     """
 
     session_key: str
     created: datetime
     redirect_uri: str
     scope: str
+    rp_id: str
     nonce: str | None = None
     code_challenge: str | None = None
 
 
 class CookieCode(msgspec.Struct):
-    """A cookie exchange code for setting session cookie after WebSocket auth."""
+    """A cookie exchange code for setting session cookie after WebSocket auth.
+
+    rp_id binds the code to the realm it was issued in; the redemption
+    endpoint (dispatched by Host) must match. This is what allows a
+    remote-auth approver on one realm to mint a code for the requesting
+    device's realm without the code being usable on the wrong realm.
+    """
 
     session_key: str
     created: datetime
+    rp_id: str
 
 
 # Separate stores for each code type