feat: implement core CLI packages and Phase 3 commands

- config: resolve binary dir, load/save .hf-config.json
- mode: detect padded-cell vs manual mode via pass_mgr
- client: HTTP client wrapper with auth header support
- passmgr: pass_mgr integration (get-secret, set, generate)
- output: human-readable + JSON output formatting with tables
- help: help and help-brief renderer for groups/commands
- commands: version, health, config (--url, --acc-mgr-token, show)
- auth: token resolution helper (padded-cell auto / manual explicit)
- main: command dispatcher with --json global flag support
- README: updated with current package layout and status

internal/help/doc.go

@@ -1,3 +0,0 @@
-package help
-
-// Package help will render help and help-brief output.

internal/help/help.go

@@ -0,0 +1,113 @@
+// Package help renders help and help-brief output for the hf CLI.
+package help
+
+import (
+	"fmt"
+	"strings"
+)
+
+// Command describes a CLI command or group.
+type Command struct {
+	Name        string
+	Description string
+	Permitted   bool     // whether the current user can execute this
+	SubCommands []Command
+}
+
+// Group describes a top-level command group.
+type Group struct {
+	Name        string
+	Description string
+	Permitted   bool
+	SubCommands []Command
+}
+
+// RenderTopHelp renders `hf --help` output showing all groups.
+func RenderTopHelp(version string, groups []Group) string {
+	var b strings.Builder
+	b.WriteString("hf - HarborForge CLI")
+	if version != "" {
+		b.WriteString(" (" + version + ")")
+	}
+	b.WriteString("\n\nUsage: hf <command> [flags]\n\n")
+	b.WriteString("Commands:\n")
+	maxLen := 0
+	for _, g := range groups {
+		if len(g.Name) > maxLen {
+			maxLen = len(g.Name)
+		}
+	}
+	for _, g := range groups {
+		b.WriteString(fmt.Sprintf("  %-*s  %s\n", maxLen, g.Name, g.Description))
+	}
+	b.WriteString("\nGlobal flags:\n")
+	b.WriteString("  --help        Show help\n")
+	b.WriteString("  --help-brief  Show only permitted commands\n")
+	b.WriteString("  --json        Output in JSON format\n")
+	return b.String()
+}
+
+// RenderTopHelpBrief renders `hf --help-brief` showing only permitted groups.
+func RenderTopHelpBrief(version string, groups []Group) string {
+	var b strings.Builder
+	b.WriteString("hf - HarborForge CLI")
+	if version != "" {
+		b.WriteString(" (" + version + ")")
+	}
+	b.WriteString("\n\nPermitted commands:\n")
+	maxLen := 0
+	for _, g := range groups {
+		if g.Permitted && len(g.Name) > maxLen {
+			maxLen = len(g.Name)
+		}
+	}
+	for _, g := range groups {
+		if g.Permitted {
+			b.WriteString(fmt.Sprintf("  %-*s  %s\n", maxLen, g.Name, g.Description))
+		}
+	}
+	return b.String()
+}
+
+// RenderGroupHelp renders `hf <group> --help` showing all subcommands.
+func RenderGroupHelp(groupName string, cmds []Command) string {
+	var b strings.Builder
+	b.WriteString(fmt.Sprintf("hf %s - subcommands:\n\n", groupName))
+	maxLen := 0
+	for _, c := range cmds {
+		if len(c.Name) > maxLen {
+			maxLen = len(c.Name)
+		}
+	}
+	for _, c := range cmds {
+		desc := c.Description
+		if !c.Permitted {
+			desc = "(not permitted)"
+		}
+		b.WriteString(fmt.Sprintf("  %-*s  %s\n", maxLen, c.Name, desc))
+	}
+	return b.String()
+}
+
+// RenderGroupHelpBrief renders `hf <group> --help-brief` showing only permitted subcommands.
+func RenderGroupHelpBrief(groupName string, cmds []Command) string {
+	var b strings.Builder
+	b.WriteString(fmt.Sprintf("hf %s - permitted subcommands:\n\n", groupName))
+	maxLen := 0
+	for _, c := range cmds {
+		if c.Permitted && len(c.Name) > maxLen {
+			maxLen = len(c.Name)
+		}
+	}
+	for _, c := range cmds {
+		if c.Permitted {
+			b.WriteString(fmt.Sprintf("  %-*s  %s\n", maxLen, c.Name, c.Description))
+		}
+	}
+	return b.String()
+}
+
+// RenderNotPermitted renders the short message for an unpermitted leaf command.
+func RenderNotPermitted(group, cmd string) string {
+	return fmt.Sprintf("hf %s %s: not permitted", group, cmd)
+}