docs: document public key allowed origins matching

[chiranjeet-vapi]

Description

• The Restrict access step only said to enter URLs in Allowed Origins. It now states origin format (scheme, host, optional port; any path ignored), single-label * wildcards, that partial wildcards never match, and that a key with no allowed origins works from any origin.
• The public key note now says restricting to assistants does not stop assistantOverrides on those assistants.
• The key types table is followed by a sentence that allowed origins and allowed assistants apply to public keys only, and that a private key can access the whole organization.

Evidence

• The TokenRestrictions schema in the OpenAPI spec defines allowedOrigins.
• Matching and overrides behavior: Confirmed against current platform behavior.

Testing Steps

• fern check (pinned 5.151.1) passes locally
• Check the preview deployment for the changed page

[lightsage-app]

Lightsage docs evals

Waiting for the staging docs URL before running evals.

Lightsage will start the selected PR evals automatically when GitHub reports a successful docs deployment for this PR. This usually happens within 15 minutes.

Commit: 3bd20b4
Status: waiting for staging docs URL

[stephenvapiai]

Two suggestions on lines outside the diff, so I can't attach them inline:

1. Line 20: line 27 now says only public keys support these restrictions, so change "then limit the key to the origins and assistants that need access" to "then limit a public key to the origins and assistants that need access."

2. Line 58: the new rules say any path is ignored, so these are origins, not URLs. Change "enter the URLs that may use the key in Allowed Origins" to "enter the origins that may use the key in Allowed Origins."

[chiranjeet-vapi]

Applied all four suggestions, thanks. I reworded the "subdomain label" definition to "one dot-separated part of the host", since the * in https://*.example.com sits before the first dot rather than between two.