"""hf-cli — operator commands run inside the backend container.

Subjects:
  admin   — bootstrap / manage the initial admin user
  config  — runtime config (OIDC, etc.)

Invoked via the shim at /usr/local/bin/hf-cli (Dockerfile-installed):
  docker exec hf-backend hf-cli admin create-user --email me@example.com --password '...'
  docker exec hf-backend hf-cli config oidc --issuer ... --client-id ... --enabled true
"""