feat(backend)!: kill AbstractWizard, env-driven config + hf-cli

Drops the AbstractWizard config-volume bootstrap entirely. All deploy-time
config now comes from docker env vars (.env). First-deploy admin user + OIDC
provider config are operator-driven via `docker exec hf_backend hf-cli ...`.

Backend changes:
- entrypoint.sh: drop config-wait loop, just exec uvicorn
- app/core/config.py: drop _resolve_db_url + OIDC_* env vars (DB only now);
  keep HARBORFORGE_OIDC_ONLY (deploy-time policy)
- app/init_wizard.py → app/init_bootstrap.py: drop load_config / admin / OIDC /
  default-project bootstrap; keep idempotent startup seed (permissions,
  default roles, acc-mgr + deleted-user builtins)
- app/main.py: /config/status now returns {initialized: <admin exists>};
  startup() imports init_bootstrap.run_bootstrap
- app/api/routers/oidc.py: get_effective_oidc reads DB only (no env fallback)
- app/services/harborforge_config.py: removed (replaced by direct env reads)
- app/services/discord_wakeup.py: HF_DISCORD_GUILD_ID / HF_DISCORD_BOT_TOKEN env
- app/api/routers/users.py + tests/conftest.py: rename init_wizard refs

New hf-cli surface (app/cli/, invoked via /usr/local/bin/hf-cli shim):
  hf-cli admin create-user --email <e> [--username <u>] [--password <p>]
                            [--oidc-issuer <url> --oidc-subject <sub>]
  hf-cli admin list
  hf-cli admin set-role --username <u> --role <admin|mgr|dev|guest|account-manager>
  hf-cli admin reset-password --username <u> --password <p>
  hf-cli admin bind-oidc --username <u> --oidc-issuer <url> --oidc-subject <sub>
  hf-cli config oidc [--issuer/...] [--client-id/...] [--client-secret/...]
                     [--redirect-uri/...] [--enabled true|false] [--show-secret]

Bootstrap migration on existing deployments: existing admin / OIDC settings
in the DB are preserved across the cutover; only the wizard config-volume
+ wizard sidecar services need to be removed from compose. Restart picks
up the new entrypoint + skips the config wait.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/cli/__main__.py

@@ -0,0 +1,48 @@
+"""hf-cli entry point. Dispatches to subject-specific modules."""
+import sys
+
+
+USAGE = """Usage:
+  hf-cli admin create-user --email <e> [--username <u>] [--full-name <n>]
+                           [--password <p>] [--oidc-issuer <url> --oidc-subject <sub>]
+  hf-cli admin list
+  hf-cli admin set-role  --username <u> --role <admin|mgr|dev|guest|account-manager>
+  hf-cli admin reset-password --username <u> --password <p>
+  hf-cli admin bind-oidc      --username <u> --oidc-issuer <url> --oidc-subject <sub>
+
+  hf-cli config oidc [--issuer <url>] [--client-id <id>] [--client-secret <s>]
+                     [--redirect-uri <url>] [--post-login-redirect <url>]
+                     [--scopes "openid email profile"] [--admin-role <role>]
+                     [--enabled true|false] [--show-secret]
+
+Reads DATABASE_URL + SECRET_KEY from the same env as the backend. Run
+inside the backend container: `docker exec hf-backend hf-cli ...`.
+"""
+
+
+def main() -> int:
+    args = sys.argv[1:]
+    if len(args) < 1:
+        sys.stderr.write(USAGE)
+        return 1
+
+    subject = args[0]
+    rest = args[1:]
+
+    if subject == "admin":
+        from app.cli import admin
+        return admin.dispatch(rest)
+    if subject == "config":
+        from app.cli import config
+        return config.dispatch(rest)
+    if subject in ("-h", "--help", "help"):
+        sys.stdout.write(USAGE)
+        return 0
+
+    sys.stderr.write(f"unknown subject: {subject}\n\n")
+    sys.stderr.write(USAGE)
+    return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())