feat: implement core CLI packages and Phase 3 commands

- config: resolve binary dir, load/save .hf-config.json
- mode: detect padded-cell vs manual mode via pass_mgr
- client: HTTP client wrapper with auth header support
- passmgr: pass_mgr integration (get-secret, set, generate)
- output: human-readable + JSON output formatting with tables
- help: help and help-brief renderer for groups/commands
- commands: version, health, config (--url, --acc-mgr-token, show)
- auth: token resolution helper (padded-cell auto / manual explicit)
- main: command dispatcher with --json global flag support
- README: updated with current package layout and status

internal/mode/doc.go

@@ -1,3 +0,0 @@
-package mode
-
-// Package mode will detect padded-cell/manual runtime behavior.

internal/mode/mode.go

@@ -0,0 +1,53 @@
+// Package mode detects whether the CLI runs in padded-cell mode or manual mode.
+package mode
+
+import (
+	"os/exec"
+	"sync"
+)
+
+// RuntimeMode represents the CLI operating mode.
+type RuntimeMode int
+
+const (
+	// ManualMode requires explicit --token / --acc-mgr-token flags.
+	ManualMode RuntimeMode = iota
+	// PaddedCellMode resolves secrets via pass_mgr automatically.
+	PaddedCellMode
+)
+
+var (
+	detectedMode RuntimeMode
+	detectOnce   sync.Once
+)
+
+// Detect checks whether pass_mgr is available and returns the runtime mode.
+// The result is cached after the first call.
+func Detect() RuntimeMode {
+	detectOnce.Do(func() {
+		_, err := exec.LookPath("pass_mgr")
+		if err == nil {
+			detectedMode = PaddedCellMode
+		} else {
+			detectedMode = ManualMode
+		}
+	})
+	return detectedMode
+}
+
+// IsPaddedCell is a convenience helper.
+func IsPaddedCell() bool {
+	return Detect() == PaddedCellMode
+}
+
+// String returns a human-readable mode name.
+func (m RuntimeMode) String() string {
+	switch m {
+	case PaddedCellMode:
+		return "padded-cell"
+	case ManualMode:
+		return "manual"
+	default:
+		return "unknown"
+	}
+}