fix: exempt /dashboard-plugins/ from OAuth auth gate (#53066)

[Sahil-SS9]

Fixes #53066

Description

Plugin static assets (JS/CSS) are served at /dashboard-plugins/<name>/<path> and loaded by the SPA via <script src> and <link href> tags — neither of which can attach custom auth headers. The OAuth gated_auth_middleware was returning 401 for these requests because /dashboard-plugins/ was missing from _GATE_PUBLIC_PREFIXES.

The route handler (serve_plugin_asset) already has its own security: path traversal check via resolve().is_relative_to() and a browser-asset suffix allowlist (JS/CSS/JSON/HTML/SVG/PNG/JPG/WOFF/etc.). Adding the prefix to the public list simply lets the request reach the handler.

Verification

• Added /dashboard-plugins/ to _GATE_PUBLIC_PREFIXES in hermes_cli/dashboard_auth/middleware.py
• Compile-check passed
• No secrets, personal refs, or unrelated changes

[alt-glitch]

This was generated by AI during triage.
Fix PR for #53066. Related: #24886 (open) also exempts the /dashboard-plugins/ asset route (paired with a write-denylist extension). This PR is the focused one-line public-prefix fix. Flagging the overlap so a maintainer can pick between the focused and broader change — not a duplicate.

[Sahil-SS9]

Thanks @alt-glitch for the triage context. #24886 is closed and took a different approach (extending the write denylist). This PR is the focused fix for #53066 — gating the /dashboard-plugins/ asset route with a read allowlist.