Add thv llm command group with config types and management commands

[yrobla]

Summary

Introduces the thv llm command group as the foundation for LLM gateway
authentication (RFC-0070 / stacklok/toolhive-rfcs#70). The thv llm feature
bridges AI coding tools to OIDC-protected LLM gateways — this PR lays the
skeleton that subsequent PRs (token source, proxy, tool adapters, setup/teardown)
will build on.

• Why: Developers in enterprise environments need ToolHive to manage OIDC
  authentication against LLM gateways. Without a persistent config model and a
  CLI entry point, nothing else in this feature can land.
• What changed:
  • pkg/llm/config.go — Config, OIDCConfig, ProxyConfig,
    ToolConfig types with IsConfigured(), ValidatePartial(), and Validate()
    (HTTPS enforcement, port range checks, required-field guards)
  • pkg/secrets/scoped.go — adds ScopeLLM secret scope for storing OIDC
    refresh tokens under __thv_llm_*
  • pkg/config/config.go — adds LLM llm.Config field (yaml:"llm,omitempty")
    to the top-level Config struct
  • cmd/thv/app/llm.go — thv llm config set/show/reset (fully implemented)
    plus stubbed setup, teardown, proxy start, and hidden token commands
  • cmd/thv/app/commands.go — registers thv llm in root command; adds llm
    to the informational-commands map (no container runtime needed)

Part of #5016. Closes #5027.

Type of change

• New feature

Test plan

• Unit tests (task test) — pkg/llm tests cover IsConfigured(),
  ValidatePartial(), Validate() (HTTPS enforcement, port range, required fields),
  EffectiveProxyPort(), EffectiveScopes()
• Linting (task lint-fix) — task license-fix run; build is clean

Does this introduce a user-facing change?

Yes — thv llm is a new top-level command group. The config set/show/reset
subcommands are fully functional. The remaining subcommands (setup, teardown,
proxy start, token) are stubbed and return "not implemented" until subsequent
PRs land.

Special notes for reviewers

• The thv llm token command is intentionally Hidden: true — it is not
  meant for direct user invocation; it serves as the apiKeyHelper/auth.command
  target for OIDC-capable AI tools.
• Config types live in pkg/llm/config.go rather than pkg/config/ as specified
  in the RFC — this keeps the LLM domain self-contained. Types are named without
  the LLM prefix (e.g. llm.Config not llm.LLMConfig) since the package
  name already provides that context.
• ScopeLLM = "llm" satisfies the no-underscore invariant documented in
  pkg/secrets/scoped.go.

Generated with Claude Code

Large PR Justification

This is adding a new thv llm command. This PR includes the basic and scaffolding. Cannot be split.

[codecov]

Codecov Report

❌ Patch coverage is 92.15686% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.78%. Comparing base (f94b99b) to head (3e510b7).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/networking/utilities.go	77.77%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5032      +/-   ##
==========================================
+ Coverage   69.09%   69.78%   +0.69%     
==========================================
  Files         556      557       +1     
  Lines       73348    56254   -17094     
==========================================
- Hits        50679    39258   -11421     
+ Misses      19648    13978    -5670     
+ Partials     3021     3018       -3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Large PR Detected

This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.

How to unblock this PR:

Add a section to your PR description with the following format:

## Large PR Justification

[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformation

Alternative:

Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.

See our Contributing Guidelines for more details.

---

This review will be automatically dismissed once you add the justification section.

PR size has been reduced below the XL threshold. Thank you for splitting this up!

[github-actions]

✅ PR size has been reduced below the XL threshold. The size review has been dismissed and this PR can now proceed with normal review. Thank you for splitting this up!

[Copilot]

Pull request overview

Adds the initial thv llm CLI surface and configuration model needed to support OIDC-protected LLM gateway authentication, including persistence in config.yaml and a dedicated secrets scope.

Changes:

• Introduces pkg/llm config types + validation helpers and accompanying unit tests.
• Adds an llm section to the top-level app config and a new secrets scope for LLM refresh tokens.
• Wires a new thv llm command group (config commands implemented; other subcommands stubbed) and generates CLI reference docs.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
pkg/secrets/scoped.go	Adds ScopeLLM for namespacing LLM-related secrets.
pkg/llm/doc.go	Package-level documentation for the new LLM domain package.
pkg/llm/config.go	Defines persisted LLM config schema + validation/defaulting helpers.
pkg/llm/config_test.go	Unit tests for configuration validation/default behavior.
pkg/config/config.go	Adds LLM llm.Config to the root config struct (llm: YAML key).
cmd/thv/app/llm.go	Implements thv llm config set/show/reset; adds stubs for setup/teardown/proxy/token.
cmd/thv/app/commands.go	Registers thv llm and marks it informational (no container runtime required).
docs/cli/thv_llm.md	Autogenerated reference for thv llm.
docs/cli/thv_llm_config.md	Autogenerated reference for thv llm config.
docs/cli/thv_llm_config_set.md	Autogenerated reference for thv llm config set.
docs/cli/thv_llm_config_show.md	Autogenerated reference for thv llm config show.
docs/cli/thv_llm_config_reset.md	Autogenerated reference for thv llm config reset.
docs/cli/thv_llm_proxy.md	Autogenerated reference for thv llm proxy.
docs/cli/thv_llm_proxy_start.md	Autogenerated reference for thv llm proxy start.
docs/cli/thv_llm_setup.md	Autogenerated reference for thv llm setup.
docs/cli/thv_llm_teardown.md	Autogenerated reference for thv llm teardown.
docs/cli/thv.md	Adds thv llm to the root command documentation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.