fix: resolve arg parsing, subshell variable loss, and decrypt issues (v0.2.1)

- Global flags (--user, --registry, --password) now work after subcommand name
- Fix raw_http variables lost in subshells by persisting to temp files
- Remove config inline-comment stripping that truncated base64 ciphertext
- Add trailing newline to openssl decrypt pipe input
- Move config path to ~/.config/hubmanager.conf
- Add "Cleaning up empty repositories" section to README

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -48,12 +48,12 @@ hubmanager prune myuser/myapp --keep 3 --dry-run
 
 ## Configuration
 
-Credentials and registry settings are stored in `~/.hubmanager.conf`.
+Credentials and registry settings are stored in `~/.config/hubmanager.conf`.
 The file uses a simple `KEY=VALUE` format:
 
 ```bash
-# ~/.hubmanager.conf
-# chmod 600 ~/.hubmanager.conf
+# ~/.config/hubmanager.conf
+# chmod 600 ~/.config/hubmanager.conf
 
 # Default registry and credentials
 REGISTRY=https://registry.example.com
@@ -91,7 +91,7 @@ hubmanager login --registry https://registry.example.com \
 # New master passphrase: ****
 # Confirm master passphrase: ****
 # Login Succeeded — bearer auth, registry: https://registry.example.com
-# Credentials saved to /home/user/.hubmanager.conf
+# Credentials saved to /home/user/.config/hubmanager.conf
 # Password stored encrypted (AES-256-CBC). Master passphrase required on each use.
 ```
 
@@ -116,7 +116,7 @@ hubmanager [OPTIONS] <command> [COMMAND OPTIONS]
                           Default: https://registry-1.docker.io
   -u, --user <username>   Username (overrides config file)
   -p, --password <pass>   Password or token (overrides config file)
-      --config <file>     Config file path (default: ~/.hubmanager.conf)
+      --config <file>     Config file path (default: ~/.config/hubmanager.conf)
       --json              Output raw JSON (pipe-friendly)
       --no-color          Disable ANSI color
   -v, --verbose           Show HTTP request details (with auth redacted)
@@ -142,7 +142,7 @@ Add `--encrypt` to store the password encrypted with AES-256-CBC (requires `open
 hubmanager login --registry https://registry.example.com \
     --user admin --password secret --save
 # Login Succeeded — bearer auth, registry: https://registry.example.com
-# Credentials saved to /home/user/.hubmanager.conf
+# Credentials saved to /home/user/.config/hubmanager.conf
 ```
 
 ---
@@ -353,6 +353,25 @@ Bearer tokens are cached in memory for the duration of the session and refreshed
 - `delete` is not supported via the v2 API on Docker Hub. Use the web UI at <https://hub.docker.com>.
 - `prune` is not supported on Docker Hub for the same reason.
 
+### Cleaning up empty repositories
+
+The Docker Registry v2 API does not provide an endpoint to delete repositories.
+After deleting all tags from a repository, it will still appear in `hubmanager list`.
+This is a limitation of the registry spec, not of hubmanager.
+
+To remove empty repositories, you need direct access to the registry host:
+
+```bash
+# 1. Delete the repository directory from storage
+rm -rf /var/lib/registry/docker/registry/v2/repositories/<repo-name>
+
+# 2. Run garbage collection to reclaim disk space
+docker exec <registry-container> registry garbage-collect /etc/docker/registry/config.yml
+
+# 3. Restart the registry so the catalog refreshes
+docker restart <registry-container>
+```
+
 ---
 
 ## JSON output