feat: implement core CLI packages and Phase 3 commands

- config: resolve binary dir, load/save .hf-config.json
- mode: detect padded-cell vs manual mode via pass_mgr
- client: HTTP client wrapper with auth header support
- passmgr: pass_mgr integration (get-secret, set, generate)
- output: human-readable + JSON output formatting with tables
- help: help and help-brief renderer for groups/commands
- commands: version, health, config (--url, --acc-mgr-token, show)
- auth: token resolution helper (padded-cell auto / manual explicit)
- main: command dispatcher with --json global flag support
- README: updated with current package layout and status

internal/commands/auth.go

@@ -0,0 +1,36 @@
+package commands
+
+import (
+	"git.hangman-lab.top/zhi/HarborForge.Cli/internal/mode"
+	"git.hangman-lab.top/zhi/HarborForge.Cli/internal/output"
+	"git.hangman-lab.top/zhi/HarborForge.Cli/internal/passmgr"
+)
+
+// ResolveToken resolves the auth token based on runtime mode.
+// In padded-cell mode, tokenFlag must be empty (enforced).
+// In manual mode, tokenFlag is required.
+func ResolveToken(tokenFlag string) string {
+	if mode.IsPaddedCell() {
+		if tokenFlag != "" {
+			output.Error("padded-cell installed, --token flag disabled, use command directly")
+		}
+		tok, err := passmgr.GetToken()
+		if err != nil {
+			output.Errorf("cannot resolve token: %v", err)
+		}
+		return tok
+	}
+	// manual mode
+	if tokenFlag == "" {
+		output.Error("--token <token> required or execute this with pcexec")
+	}
+	return tokenFlag
+}
+
+// RejectTokenInPaddedCell checks if --token was passed in padded-cell mode
+// and terminates with the standard error message.
+func RejectTokenInPaddedCell(tokenFlag string) {
+	if mode.IsPaddedCell() && tokenFlag != "" {
+		output.Error("padded-cell installed, --token flag disabled, use command directly")
+	}
+}