feat: user reset-apikey supports acc-mgr-token auth

Allows reset-apikey to use --acc-mgr-token or auto-resolve from
secret-mgr in padded-cell mode, enabling API key provisioning
without an existing user Bearer token.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cmd/hf/main.go

@@ -345,7 +345,7 @@ func handleUserCommand(subCmd string, args []string) {
 		if len(filtered) < 1 {
 			output.Error("usage: hf user reset-apikey <username>")
 		}
-		commands.RunUserResetAPIKey(filtered[0], tokenFlag)
+		commands.RunUserResetAPIKey(filtered[0], tokenFlag, accMgrTokenFlag)
 	default:
 		output.Errorf("hf user %s is not implemented yet", subCmd)
 	}