feat: add OpenClaw-style dashboard authentication

[asarlashmit]

Summary

This PR adds OpenClaw-style authentication to the Hermes web dashboard while preserving the current localhost-first default behavior.

Features added

• Adds a centralized DashboardAuthManager with auth modes:
  • none for the existing local-only unauthenticated UX
  • token for bearer/header token authentication
  • password for password login with ephemeral dashboard sessions
  • trusted-proxy for reverse-proxy identity headers
  • tailscale for Tailscale identity headers
• Adds dashboard auth CLI/config/env wiring:
  • hermes dashboard --auth {none,token,password,trusted-proxy,tailscale}
  • --auth-token
  • --auth-password
  • --auth-password-hash
  • trusted-proxy and Tailscale identity header flags
  • dashboard.auth.* defaults in config
  • HERMES_DASHBOARD_AUTH_MODE, HERMES_DASHBOARD_TOKEN, HERMES_DASHBOARD_PASSWORD, and HERMES_DASHBOARD_PASSWORD_HASH
• Keeps dashboard auth disabled by default for local-only usage:
  • plain hermes dashboard still binds to 127.0.0.1:9119
  • auth mode defaults to none
• Adds remote-bind safety:
  • non-loopback binds like --host 0.0.0.0 refuse to start unless robust auth is enabled
  • --insecure remains available as an explicit override
• Protects dashboard HTTP APIs, plugin routes, and dashboard WebSocket endpoints:
  • /api/pty
  • /api/ws
  • /api/pub
  • /api/events
• Adds frontend auth UX:
  • AuthGate for token/password login
  • sessionStorage-only credential/session persistence
  • token bootstrap via URL fragment (#token=...) instead of query string
  • strips bootstrap tokens from the browser URL after capture
  • retries/recovers cleanly on 401/logout
• Adds Docker Compose smoke coverage for dashboard auth modes.

Code changes

• hermes_cli/dashboard_auth.py
  • New dashboard auth subsystem with token/password/session validation, identity headers, rate limiting, session TTL, env/config precedence, and auth status payloads.
• hermes_cli/web_server.py
  • Wires dashboard auth into protected HTTP routes and WebSocket endpoints.
  • Adds public auth endpoints for status/login/logout/me.
  • Preserves localhost default behavior and blocks public binds without robust auth unless --insecure is passed.
  • Opens token-mode browser bootstrap URLs with #token= fragments.
• hermes_cli/main.py
  • Adds hermes dashboard auth flags and merges CLI overrides with persistent config.
• hermes_cli/config.py
  • Adds default dashboard.auth config tree.
• web/src/components/AuthGate.tsx, web/src/lib/dashboardAuth.ts, and related web client files
  • Adds browser-side auth state, token/password login, fragment bootstrap, sessionStorage handling, and auth headers for REST/WebSocket calls.
• docker/dashboard-auth/*
  • Adds Docker Compose smoke environment covering none/token/password/trusted-proxy/tailscale modes.
• Tests added/updated across dashboard auth manager, config, CLI, HTTP, WebSocket, Docker smoke, and Ollama Cloud auth regression coverage.

Security notes

• Auth remains off by default only for the existing localhost-only dashboard behavior.
• Public/non-loopback bind without robust auth is refused by default.
• Token bootstrap uses URL fragments and sessionStorage rather than query strings/localStorage.
• Password login exchanges the password for an ephemeral dashboard session token.
• Rate limiting and lockouts cover failed credential attempts.
• Trusted-proxy/Tailscale modes require explicit identity headers and can enforce allowlists.

[teknium1]

Thanks for the dashboard-authentication work. This is an automated hermes-sweeper review; current main now implements the requested protection through a broader provider-based system.

• hermes_cli/web_server.py:393-412 requires authentication for every non-loopback bind and makes --insecure a no-op, closing the public-bind escape hatch.
• hermes_cli/web_server.py:16920-16989 fails closed when no DashboardAuthProvider is configured.
• plugins/dashboard_auth/basic and the tested password-login flow provide the self-hosted password path; hermes_cli/dashboard_auth/routes.py:613-642 mints short-lived single-use WebSocket tickets.
• The core gate was introduced by 53736b3922604104379b5fdf7ffbed626ca1d288, with the bundled password provider added in acb0e2bacb8b893a1cc2cc16bdeeca2432c373d9.

Closing as implemented on main.