Publish thv llm commands and regenerate CLI reference docs

Remove Hidden: true from the thv llm command group and thv llm token
subcommand, making them visible in help output and CLI reference.
Update the command description to reflect that both proxy and
token-helper modes are now supported (not planned). Regenerate
docs/cli/ to include the full thv llm subcommand tree.

Author: taskbot

cmd/thv-operator/controllers/mcpserver_resource_overrides_test.go

@@ -647,7 +647,8 @@ func TestDeploymentForMCPServer_PodTemplateOverridesPreserveRunConfigChecksum(t
 		},
 	}
 
-	deployment := r.deploymentForMCPServer(t.Context(), mcpServer, "C1")
+	deployment, err := r.deploymentForMCPServer(t.Context(), mcpServer, "C1")
+	require.NoError(t, err)
 	require.NotNil(t, deployment)
 
 	assert.Equal(t, "C1",
@@ -688,7 +689,8 @@ func TestDeploymentNeedsUpdate_StableAfterBuildWithPodTemplateOverrides(t *testi
 	}
 
 	const runConfigChecksum = "stable-checksum"
-	built := r.deploymentForMCPServer(t.Context(), mcpServer, runConfigChecksum)
+	built, err := r.deploymentForMCPServer(t.Context(), mcpServer, runConfigChecksum)
+	require.NoError(t, err)
 	require.NotNil(t, built)
 
 	// Constructor and comparator must agree on the same input — otherwise the

cmd/thv/app/llm.go

@@ -24,13 +24,12 @@ import (
 
 func newLLMCommand() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:    "llm",
-		Hidden: true,
-		Short:  "Manage LLM gateway authentication",
+		Use:   "llm",
+		Short: "Manage LLM gateway authentication",
 		Long: `Configure and manage authentication for OIDC-protected LLM gateways.
 
 The llm command bridges AI coding tools to LLM gateways by handling OIDC
-authentication transparently. Two modes are planned:
+authentication transparently. Two modes are supported:
 
   Proxy mode    — a localhost reverse proxy injects fresh tokens for tools
                   that only accept static API keys (e.g. Cursor).
@@ -476,13 +475,12 @@ func runLLMProxyForeground(ctx context.Context, llmCfg *llm.Config) error {
 	return p.Start(ctx)
 }
 
-// ── token helper (hidden) ─────────────────────────────────────────────────────
+// ── token helper ──────────────────────────────────────────────────────────────
 
 func newLLMTokenCommand() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:    "token",
-		Hidden: true,
-		Short:  "Print a fresh LLM gateway access token to stdout",
+		Use:   "token",
+		Short: "Print a fresh LLM gateway access token to stdout",
 		Long: `Print a fresh OIDC access token to stdout (all other output on stderr).
 Intended for use as apiKeyHelper or auth.command in OIDC-capable AI tools.
 Runs non-interactively — will not launch a browser flow.`,