Add JSON output to vMCP validation

[Whxuan0701]

Summary

Automation and Agent harnesses need a stable validation result, but thv vmcp validate currently emits only human-oriented logs. Parsing those logs is brittle and can accidentally expose configuration details that machine consumers do not need.

• Add --format json to thv vmcp validate while preserving the existing text behavior by default.
• Return a stable, secret-free summary containing validation status and configuration metadata/counts.
• Validate output formats, route JSON through Cobra's output writer, and document the new flag.

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task -t Taskfile.focused.yml test, using the repository's -race, linker, and gotestfmt settings for ./pkg/vmcp/cli and ./cmd/thv/app)
• E2E tests (task test-e2e)
• Linting (task lint-fix)
• Manual testing (describe below)

The full task test suite was also attempted. It reached the test phase but unrelated Docker-dependent API/runtime and Envoy container tests could not run because Docker is unavailable in the local environment.

API Compatibility

• This PR does not break the v1beta1 API.

Changes

File	Change
pkg/vmcp/cli/validate.go	Add stable JSON summary generation with a restricted, secret-free schema.
pkg/vmcp/cli/validate_test.go	Verify the JSON field contract, sensitive-value exclusion, and text compatibility.
cmd/thv/app/vmcp.go	Add the standard format flag and use Cobra's output writer.
cmd/thv/app/vmcp_test.go	Cover format validation and command-level JSON output.
docs/cli/thv_vmcp_validate.md	Document the generated --format flag.

Does this introduce a user-facing change?

Yes. Users can now run thv vmcp validate --config <path> --format json and consume a stable validation summary from stdout.

Special notes for reviewers

The JSON schema deliberately omits backend URLs, headers, policy contents, expanded environment values, and other configuration payloads. backend_auth_override_count counts backend-specific outgoing-auth overrides; backend_count counts configured static backends.