dhi: refresh customize & mirror (#24730)

## Description

Refreshing and reducing left nav sprawl.

- Removed management topic. It's not a standalone use-case. The use-case
is managing mirrored and customized repos, so moved the info into those
topics to reduce left nav sprawl.

- For Mirror and Customize:
  - Moved Hub and CLI workflows to tabs.
- Added Terraform tab showing how to manage mirrors and customizations
using the [DHI Terraform
provider](https://registry.terraform.io/providers/docker-hardened-images/dhi/latest/docs).
The mirror topic includes provider setup (install + auth), and the
customize topic links back to it.
- Added additional related CLI commands in order to eventually remove
the standalone CLI topic.
- Added necessary token (PAT/OAT) support/scoping for mirroring and
customization.
- Moved the how to use an OAT with oras out of the mirror topic and into
the use topic in the CI/CD section. OATs can't be used to mirror.
Reframed the example to be about oras rather than OAT based on the
requirement. Xref'd to the OAT topic for creation steps.
- Moved webhook section in Mirror from Hub section to third-party mirror
section.
- In Mirror, changed wording from "mirror to hub" to "mirror to your
organization" to be more specific.

- Added warning for examples using credentials in CLI

Previews
-
https://deploy-preview-24616--docsdocker.netlify.app/dhi/how-to/mirror/
-
https://deploy-preview-24616--docsdocker.netlify.app/dhi/how-to/customize/
-
https://deploy-preview-24616--docsdocker.netlify.app/dhi/how-to/use/#discover-attestations-with-oras

## Related issues or tickets

ENGDOCS-3222 - topic refresh
ENGDOCS-3224 - add token scopes
ENGDOCS-3231 - add terraform

## Reviews

<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->

- [ ] Editorial review
- [ ] Technical review

---------

Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>

Author: craig-osterhout

content/manuals/dhi/how-to/_index.md

@@ -2,6 +2,8 @@
 title: How-tos
 description: Step-by-step guidance for working with Docker Hardened Images, from discovery to governance.
 weight: 20
+aliases:
+  - /dhi/how-to/manage/
 params:
   grid_discover:
     - title: Search and evaluate Docker Hardened Images
@@ -37,10 +39,6 @@ params:
       description: Learn how to use a Docker Hardened Image chart.
       icon: leaderboard
       link: /dhi/how-to/helm/
-    - title: Manage Docker Hardened Images and charts
-      description: Learn how to manage your mirrored and customized Docker Hardened Images in your organization.
-      icon: reorder
-      link: /dhi/how-to/manage/
   grid_verify:
     - title: Verify a Docker Hardened Image or chart
       description: Use Docker Scout or cosign to verify signed attestations like SBOMs, provenance, and vulnerability data for Docker Hardened Images and charts.

content/manuals/dhi/how-to/cli.md

@@ -76,7 +76,7 @@ docker dhi mirror start --org my-org \
 Mirror with dependencies:
 
 ```bash
-docker dhi mirror start --org my-org -r golang --dependencies
+docker dhi mirror start --org my-org -r dhi/golang,my-org/dhi-golang --dependencies
 ```
 
 List mirrored images in your organization:

content/manuals/dhi/how-to/customize.md

@@ -2,7 +2,7 @@
 title: Customize a Docker Hardened Image or chart
 linkTitle: Customize an image or chart
 weight: 25
-keywords: hardened images, DHI, customize, certificate, artifact, helm chart
+keywords: hardened images, DHI, customize, certificate, artifact, helm chart, terraform, infrastructure as code
 description: Learn how to customize Docker Hardened Images (DHI) and charts.
 ---
 
@@ -14,7 +14,6 @@ Hub web interface. For images, this lets you select a base image, add packages,
 add OCI artifacts (such as custom certificates or additional tools), and
 configure settings. For charts, this lets you customize the image references.
 
-
 Your customizations stay secure automatically. When the base Docker Hardened
 Image or chart receives a security patch or your OCI artifacts are updated,
 Docker automatically rebuilds your customizations in the background. This
@@ -32,35 +31,8 @@ mirrored DHI repository can create a customized image.
 
 You can create customizations using either the DHI CLI or the Docker Hub web interface.
 
-### Customize using the DHI CLI
-
-The DHI CLI provides a command-line interface for managing Docker Hardened Image
-customizations. For installation instructions and usage details, see [Use
-the DHI CLI](./cli.md#customize-dhi-images).
-
-#### Monitor customization builds
-
-List builds for a customization:
-
-```console
-$ docker dhi customization build list --org my-org my-org/dhi-golang "golang with git"
-```
-
-Get details of a specific build:
-
-```console
-$ docker dhi customization build get --org my-org my-org/dhi-golang "golang with git" <build-id>
-```
-
-View build logs:
-
-```console
-$ docker dhi customization build logs --org my-org my-org/dhi-golang "golang with git" <build-id>
-```
-
-### Customize using the Docker Hub web interface
-
-To customize a Docker Hardened Image using the web interface, follow these steps:
+{{< tabs >}}
+{{< tab name="Docker Hub" >}}
 
 1. Sign in to [Docker Hub](https://hub.docker.com).
 1. Select **My Hub**.
@@ -158,6 +130,130 @@ To customize a Docker Hardened Image using the web interface, follow these steps
    to build. Once built, it will appear in the **Tags** tab of the repository,
    and your team members can pull it like any other image.
 
+{{< /tab >}}
+{{< tab name="CLI" >}}
+
+Authenticate with `docker login` using your Docker credentials or a [personal
+access token (PAT)](../../security/access-tokens.md) with **Read & Write**
+permissions. [Organization access tokens
+(OATs)](../../enterprise/security/access-tokens.md) are not supported.
+
+Use the [`docker dhi customization`](/reference/cli/docker/dhi/customization/) command:
+
+```console
+# Prepare a customization scaffold
+$ docker dhi customization prepare golang 1.25 \
+  --org my-org \
+  --destination my-org/dhi-golang \
+  --name "golang with git" \
+  --output my-customization.yaml
+
+# Create a customization
+$ docker dhi customization create my-customization.yaml --org my-org
+
+# List customizations
+$ docker dhi customization list --org my-org
+
+# Filter customizations by name, repository, or source
+$ docker dhi customization list --org my-org --filter git
+$ docker dhi customization list --org my-org --repo dhi-golang
+$ docker dhi customization list --org my-org --source golang
+
+# Get a customization
+$ docker dhi customization get my-org/dhi-golang "golang with git" --org my-org --output my-customization.yaml
+
+# Update a customization
+$ docker dhi customization edit my-customization.yaml --org my-org
+
+# Delete a customization
+$ docker dhi customization delete my-org/dhi-golang "golang with git" --org my-org
+
+# Delete without confirmation prompt
+$ docker dhi customization delete my-org/dhi-golang "golang with git" --org my-org --yes
+```
+
+{{< /tab >}}
+{{< tab name="Terraform" >}}
+
+You can manage DHI customizations as infrastructure-as-code using the [DHI
+Terraform
+provider](https://registry.terraform.io/providers/docker-hardened-images/dhi/latest/docs).
+If you haven't configured the provider yet, see the Terraform tab in [Mirror a
+repository](./mirror.md) for setup instructions.
+
+Define a `dhi_customization` resource for each customization:
+
+```hcl
+resource "dhi_customization" "golang_with_git" {
+  repository = "dhi-golang"
+  name       = "golang with git"
+
+  contents {
+    packages = ["git", "curl"]
+  }
+
+  platform {
+    os           = "linux"
+    architecture = "amd64"
+  }
+}
+```
+
+The `dhi_customization` resource also supports optional configuration blocks
+for `accounts`, `files`, `labels`, `annotations`, `environment`, `entrypoint`,
+`cmd`, `user`, `workdir`, and `stop_signal`.
+
+Run `terraform apply` to create the customization.
+
+To edit a customization, update the resource configuration and run `terraform
+apply`. To delete a customization, remove the resource and run `terraform apply`.
+
+For the full list of resource attributes, see the [Terraform Registry
+documentation](https://registry.terraform.io/providers/docker-hardened-images/dhi/latest/docs/resources/customization).
+
+> [!NOTE]
+>
+> Monitoring customization builds is not available through the Terraform
+> provider. Use the Docker Hub web interface or the DHI CLI to monitor builds.
+
+{{< /tab >}}
+{{< /tabs >}}
+
+### Monitor customization builds
+
+{{< tabs >}}
+{{< tab name="Docker Hub" >}}
+
+1. Sign in to [Docker Hub](https://hub.docker.com).
+2. Select **My Hub**.
+3. In the namespace drop-down, select your organization.
+4. Select **Hardened Images** > **Manage**.
+5. Select the **Customizations** tab.
+
+{{< /tab >}}
+{{< tab name="CLI" >}}
+
+List builds for a customization:
+
+```console
+$ docker dhi customization build list my-org/dhi-golang "golang with git" --org my-org
+```
+
+Get details of a specific build:
+
+```console
+$ docker dhi customization build get my-org/dhi-golang "golang with git" <build-id> --org my-org
+```
+
+View build logs:
+
+```console
+$ docker dhi customization build logs my-org/dhi-golang "golang with git" <build-id> --org my-org
+```
+
+{{< /tab >}}
+{{< /tabs >}}
+
 ### Create an OCI artifact image for image customization
 
 An OCI artifact image is a Docker image that contains files or directories that