Merge PR #2280: feat(cli): CLI v4 — Commander.js, 50+ commands, TUI, i18n, plugins (Phases 0-9)

Complete rewrite of the OmniRoute CLI:
- Commander.js-based modular architecture (50+ command files)
- Full i18n support (en + pt-BR, 1222 keys each)
- TUI interactive interface (OAuthFlow, EvalWatch, ProvidersTestAll)
- Plugin system (omniroute-cmd-*)
- OpenAPI codegen (omniroute api <tag> <op>)
- Commands: serve, combo, compression, keys, tunnel, backup, test-provider,
  health, memory, MCP, A2A, oauth, skills, webhooks, usage, cost, eval,
  context-eng, dashboard, doctor, env, files, logs, models, nodes, oneproxy,
  open, openapi, plugin, policy, pricing, providers, quota, registry, repl,
  reset-encrypted-columns, resilience, restart, runtime, sessions, setup,
  simulate, status, stop, stream, sync, tags, telemetry, translator, tray, update
- Code review fixes: C1-C3, I1-I5, M1-M4 applied

# Conflicts:
#	bin/cli/commands/config.mjs
#	bin/omniroute.mjs
#	package-lock.json
#	package.json

docs/reference/CLI-TOOLS.md

@@ -41,9 +41,8 @@ Claude / Codex / OpenCode / Cline / KiloCode / Continue / Cursor / Windsurf / He
 ### Source of Truth
 
 The dashboard cards in `/dashboard/cli-tools` are generated from
-`src/shared/constants/cliTools.ts`. The internal helper `bin/cli-commands.mjs`
-keeps the small set of "fully scriptable" tools that `omniroute setup` can write
-config files for automatically.
+`src/shared/constants/cliTools.ts`. The `omniroute setup` command can write
+config files automatically for the scriptable tools.
 
 ### Current Catalog (v3.8.0)
 
@@ -450,15 +449,12 @@ The `omniroute` binary (installed via `npm install -g omniroute` or bundled
 with the desktop app) provides commands beyond running the server. The full
 matrix is implemented in:
 
-- `bin/omniroute.mjs` — entry point and `--help` text
-- `bin/cli/index.mjs` — dispatcher for the supported subcommands
-- `bin/cli/commands/setup.mjs`, `bin/cli/commands/doctor.mjs`,
-  `bin/cli/commands/providers.mjs` — the three core subcommands
-
-Other subcommands listed in `--help` (status, logs, combo, keys, mcp, a2a,
-tunnel, backup, restore, quota, health, cache, env, completion, dashboard,
-serve, stop, restart, open, update, test) are wired through
-`bin/cli-commands.mjs` and require a running server for most of them.
+- `bin/omniroute.mjs` — entry point, env loading, special-case dispatch (`--mcp`)
+- `bin/cli/program.mjs` — Commander program builder
+- `bin/cli/commands/<cmd>.mjs` — one file per command/group, registered in `registry.mjs`
+- `bin/cli/output.mjs` — output formatters (json/jsonl/table/csv)
+- `bin/cli/runtime.mjs` — withRuntime helper (server-first/db-fallback)
+- `bin/cli/i18n.mjs` — t() helper with locales
 
 ### Server Lifecycle
 
@@ -541,10 +537,9 @@ omniroute reset-encrypted-columns       # Show warning + dry-run for encrypted c
 omniroute reset-encrypted-columns --force  # Actually null out encrypted credentials in SQLite
 ```
 
-### Other subcommands (via `cli-commands.mjs`)
+### Other subcommands
 
-These are dispatched in `bin/cli-commands.mjs` and assume a running OmniRoute
-server, unless noted otherwise:
+These assume a running OmniRoute server, unless noted otherwise:
 
 ```bash
 omniroute status                       # Comprehensive runtime status

docs/reference/ENVIRONMENT.md

@@ -295,6 +295,20 @@ CLI_ALLOW_CONFIG_WRITES=true
 CLI_CLAUDE_BIN=/host-cli/bin/claude
 ```
 
+### CLI Binary (`omniroute`) helpers
+
+These variables tune the `omniroute` CLI binary's own behavior (not the sidecar
+detection above).
+
+| Variable                    | Default    | Source File                             | Description                                                                                                                     |
+| --------------------------- | ---------- | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| `OMNIROUTE_LANG`            | _(system)_ | `bin/cli/i18n.mjs`                      | Force CLI output language. BCP-47 locale (e.g. `en`, `pt-BR`). Overrides system locale env vars (LC_ALL, LC_MESSAGES).          |
+| `OMNIROUTE_SHOW_LOG`        | _(unset)_  | `bin/cli/runtime/processSupervisor.mjs` | Set to `1` to forward server stdout/stderr to the terminal in supervised mode. Equivalent to `--log` flag on `omniroute serve`. |
+| `OMNIROUTE_CLI_TOKEN`       | _(unset)_  | `bin/cli/api.mjs`                       | Machine-auth token injected as `x-omniroute-cli-token` header. Auto-generated in task 8.12.                                     |
+| `OMNIROUTE_HTTP_TIMEOUT_MS` | `30000`    | `bin/cli/api.mjs`                       | Per-attempt HTTP timeout (ms) for CLI → server requests.                                                                        |
+| `OMNIROUTE_VERBOSE`         | `0`        | `bin/cli/api.mjs`                       | Set to `1` to print retry/backoff diagnostics to stderr during CLI commands.                                                    |
+| `OMNIROUTE_PLUGIN_PATH`     | _(unset)_  | `bin/cli/plugins.mjs`                   | Custom directory for CLI plugin discovery (`omniroute-cmd-*` packages). Defaults to `~/.omniroute/plugins/` when unset.         |
+
 ---
 
 ## 10. Internal Agent & MCP Integrations