Finish the realm→domain terminology removal across source, tests, e2e
and docs. The stored config drops all lists: Config.domains is keyed by
rp-id, DomainConfig.origins/related are objects keyed by host (https://
omitted), values True or OriginEntry(auth_host=True). The default/primary
domain concept is gone; ordering is display-time. Tests and e2e updated
to the new API shapes (not run). Database re-migrated from the legacy
backup into the new format.
- global-setup bootstraps via one-shot 'paskia init --rp-id
localhost,test.localhost' in the test-data directory (which doubles as
the server cwd, dropping the removed PASKIA_DB), captures the reset
token from init output (stdout+stderr), then spawns plain serve.
- New 50-multirealm spec: per-host settings dispatch, 421 for unknown
hosts, /.well-known/webauthn 404 until a related origin is added via
the admin realm API (and removed again), and a full cross-realm remote
login: requester on test.localhost, permit on localhost with a fresh
virtual-authenticator passkey, session validated on test.localhost.
Asserts the profile enrollment prompt and realm badge render.
- New fixtures/remote-auth.ts drives the remote-auth WS protocol in
browser context, including the PBKDF2 PoW.
LeoVasanko