CLI: explicit 'paskia migrate' subcommand for legacy conversion

Serve never converts databases: with no paskia.kantadb it points at
'paskia init', or at 'paskia migrate' when legacy *.paskiadb candidates
exist. migrate converts a lone candidate, or the one named by --rp-id
when several exist; the rest stay in place. devserver fails fast with
the same hint. gitignore covers paskia.kantadb and *.converted-bak.

tests/test_cli.py

@@ -1,8 +1,9 @@
 """Tests for the CLI entry point in paskia/__main__.py.
 
 The CLI is split into ``paskia init`` (create the combined paskia.kantadb
-with the initial realm(s)) and bare ``paskia`` (serve the stored realms,
-adopting a lone legacy ``<rp-id>.paskiadb`` database if present).
+with the initial realm(s)), ``paskia migrate`` (convert a legacy
+``<rp-id>.paskiadb`` database), and bare ``paskia`` (serve the stored
+realms; never migrates).
 """
 
 from __future__ import annotations
@@ -165,7 +166,13 @@ def test_serve_listen_override_not_persisted(run_cli, tmp_path):
     assert stored_config(tmp_path).listen == ["4402"]
 
 
-def test_serve_adopts_legacy_database(run_cli, tmp_path):
+def test_serve_suggests_migrate_when_legacy_present(run_cli, tmp_path):
+    write_legacy_db(tmp_path, legacy.LegacyConfig(rp_id="example.com"))
+    with pytest.raises(SystemExit, match="paskia migrate"):
+        run_cli()
+
+
+def test_migrate_converts_legacy_database(run_cli, tmp_path):
     src_dir = write_legacy_db(
         tmp_path, legacy.LegacyConfig(rp_id="example.com", rp_name="Legacy Name")
     )
@@ -174,12 +181,12 @@ def test_serve_adopts_legacy_database(run_cli, tmp_path):
     avatar.mkdir(parents=True)
     (avatar / "profile.webp").write_bytes(b"RIFF1234WEBP")
 
-    run_cli()
+    run_cli("migrate")
 
     config = stored_config(tmp_path)
     assert [r.rp_id for r in config.realms] == ["example.com"]
     assert config.realms[0].rp_name == "Legacy Name"
-    # Legacy directory renamed aside, user files adopted
+    # Legacy directory renamed aside, user files moved over
     assert not src_dir.exists()
     assert (tmp_path / "example.com.paskiadb.converted-bak").is_dir()
     assert (
@@ -191,11 +198,41 @@ def test_serve_adopts_legacy_database(run_cli, tmp_path):
     ).read_bytes() == b"RIFF1234WEBP"
 
 
-def test_serve_multiple_legacy_databases_abort(run_cli, tmp_path):
+def test_migrate_multiple_legacy_databases_require_rp_id(run_cli, tmp_path):
     write_legacy_db(tmp_path, legacy.LegacyConfig(rp_id="one.com"))
     write_legacy_db(tmp_path, legacy.LegacyConfig(rp_id="two.com"))
-    with pytest.raises(SystemExit, match="Multiple legacy"):
-        run_cli()
+    with pytest.raises(SystemExit, match="--rp-id"):
+        run_cli("migrate")
+
+
+def test_migrate_explicit_rp_id_selects_candidate(run_cli, tmp_path):
+    write_legacy_db(tmp_path, legacy.LegacyConfig(rp_id="one.com"))
+    write_legacy_db(tmp_path, legacy.LegacyConfig(rp_id="two.com"))
+
+    run_cli("migrate", "--rp-id", "two.com")
+
+    config = stored_config(tmp_path)
+    assert [r.rp_id for r in config.realms] == ["two.com"]
+    # The other candidate is left in place
+    assert (tmp_path / "one.com.paskiadb").is_dir()
+    assert (tmp_path / "two.com.paskiadb.converted-bak").is_dir()
+
+
+def test_migrate_unknown_rp_id(run_cli, tmp_path):
+    write_legacy_db(tmp_path, legacy.LegacyConfig(rp_id="one.com"))
+    with pytest.raises(SystemExit, match="nope.com.paskiadb"):
+        run_cli("migrate", "--rp-id", "nope.com")
+
+
+def test_migrate_refuses_existing_database(run_cli):
+    run_cli("init")
+    with pytest.raises(SystemExit, match="already exists"):
+        run_cli("migrate")
+
+
+def test_migrate_without_legacy_database(run_cli):
+    with pytest.raises(SystemExit, match="No legacy"):
+        run_cli("migrate")
 
 
 def test_cli_help():
@@ -218,3 +255,14 @@ def test_cli_init_help():
     )
     assert result.returncode == 0
     assert "Bootstrap" in result.stdout
+
+
+def test_cli_migrate_help():
+    result = subprocess.run(
+        [sys.executable, "-m", "paskia", "migrate", "--help"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    assert result.returncode == 0
+    assert "Convert" in result.stdout