feat: implement user commands (list, get, create, update, activate, deactivate, delete)

- Add internal/commands/user.go with full user CRUD implementation
- Wire user subcommands in main.go dispatch
- Mark user subcommands as Permitted: true
- Support both padded-cell and manual mode for all user commands
- user create uses account-manager token flow per plan

cmd/hf/main.go

@@ -137,9 +137,104 @@ func handleGroup(group help.Group, args []string) {
 		return
 	}
 
+	// Dispatch implemented commands
+	remaining := args[1:]
+	switch group.Name {
+	case "user":
+		handleUserCommand(sub.Name, remaining)
+		return
+	}
+
 	output.Errorf("hf %s %s is recognized but not implemented yet", group.Name, sub.Name)
 }
 
+func handleUserCommand(subCmd string, args []string) {
+	// Extract --token and --acc-mgr-token flags from args
+	tokenFlag := ""
+	accMgrTokenFlag := ""
+	var filtered []string
+	for i := 0; i < len(args); i++ {
+		switch args[i] {
+		case "--token":
+			if i+1 < len(args) {
+				i++
+				tokenFlag = args[i]
+			}
+		case "--acc-mgr-token":
+			if i+1 < len(args) {
+				i++
+				accMgrTokenFlag = args[i]
+			}
+		default:
+			filtered = append(filtered, args[i])
+		}
+	}
+
+	switch subCmd {
+	case "list":
+		commands.RunUserList(tokenFlag)
+	case "get":
+		if len(filtered) < 1 {
+			output.Error("usage: hf user get <username>")
+		}
+		commands.RunUserGet(filtered[0], tokenFlag)
+	case "create":
+		username, password, email, fullName := "", "", "", ""
+		for i := 0; i < len(filtered); i++ {
+			switch filtered[i] {
+			case "--user":
+				if i+1 < len(filtered) {
+					i++
+					username = filtered[i]
+				}
+			case "--pass":
+				if i+1 < len(filtered) {
+					i++
+					password = filtered[i]
+				}
+			case "--email":
+				if i+1 < len(filtered) {
+					i++
+					email = filtered[i]
+				}
+			case "--full-name":
+				if i+1 < len(filtered) {
+					i++
+					fullName = filtered[i]
+				}
+			default:
+				output.Errorf("unknown flag: %s", filtered[i])
+			}
+		}
+		if username == "" {
+			output.Error("usage: hf user create --user <username>")
+		}
+		commands.RunUserCreate(username, password, email, fullName, accMgrTokenFlag)
+	case "update":
+		if len(filtered) < 1 {
+			output.Error("usage: hf user update <username> [--email ...] [--full-name ...] [--pass ...] [--active ...]")
+		}
+		commands.RunUserUpdate(filtered[0], filtered[1:], tokenFlag)
+	case "activate":
+		if len(filtered) < 1 {
+			output.Error("usage: hf user activate <username>")
+		}
+		commands.RunUserActivate(filtered[0], tokenFlag)
+	case "deactivate":
+		if len(filtered) < 1 {
+			output.Error("usage: hf user deactivate <username>")
+		}
+		commands.RunUserDeactivate(filtered[0], tokenFlag)
+	case "delete":
+		if len(filtered) < 1 {
+			output.Error("usage: hf user delete <username>")
+		}
+		commands.RunUserDelete(filtered[0], tokenFlag)
+	default:
+		output.Errorf("hf user %s is not implemented yet", subCmd)
+	}
+}
+
 func isHelpFlagOnly(args []string) bool {
 	return len(args) == 1 && (args[0] == "--help" || args[0] == "-h")
 }
@@ -174,13 +269,13 @@ func topGroups() []help.Group {
 			Description: "Manage users",
 			Permitted:   true,
 			SubCommands: []help.Command{
-				{Name: "create", Description: "Create a user account (uses account-manager token flow)", Permitted: false},
-				{Name: "list", Description: "List users", Permitted: false},
-				{Name: "get", Description: "Show a user by username", Permitted: false},
-				{Name: "update", Description: "Update a user", Permitted: false},
-				{Name: "activate", Description: "Activate a user", Permitted: false},
-				{Name: "deactivate", Description: "Deactivate a user", Permitted: false},
-				{Name: "delete", Description: "Delete a user", Permitted: false},
+				{Name: "create", Description: "Create a user account (uses account-manager token flow)", Permitted: true},
+				{Name: "list", Description: "List users", Permitted: true},
+				{Name: "get", Description: "Show a user by username", Permitted: true},
+				{Name: "update", Description: "Update a user", Permitted: true},
+				{Name: "activate", Description: "Activate a user", Permitted: true},
+				{Name: "deactivate", Description: "Deactivate a user", Permitted: true},
+				{Name: "delete", Description: "Delete a user", Permitted: true},
 			},
 		},
 		{