README §Installation: update-secrets.sh behaviour around HF_TOKEN misdocumented

Summary

Two README ↔ code drifts found during cold-turkey testing:

1. update-secrets.sh and hf-secret

README §"Installation" (line 191) says update-secrets.sh "Creates/updates hf-secret (skips token if not set)". The actual script skips entirely if HF_TOKEN is unset, leaving hf-secret absent. On kind this causes:

CreateContainerConfigError: secret "hf-secret" not found

Either the README is wrong (it should say the secret is only created when HF_TOKEN is set) or the script should create a placeholder secret so the MCP pod can start.

2. OPENAI_API_BASE documented as optional but practically mandatory

OPENAI_API_BASE is documented on line 79 as the variable to point at your endpoint, but listed on line 201 as "optional". When using an OpenAI-compatible proxy (which the default openai/Azure/gpt-4.1 model requires), leaving it unset causes every LLM call to return Incorrect API key even after update-secrets.sh has patched the key correctly.

The README should clarify: "OPENAI_API_BASE is required when using an OpenAI-compatible proxy."

Found in

PR #33 review by @kellyaa.

Read the Installation sections around lines 79, 191, and 201 in README, then inspect update-secrets.sh to confirm its HF_TOKEN behavior. Check PR #33's review context and document the chosen behavior for hf-secret, along with when OPENAI_API_BASE is required; done means the README matches the script and proxy setup no longer appears contradictory.