fix(dashboard): skip auto-SSO redirect for password-only providers (#55130)

[liuhao1024]

What does this PR do?

Fixes HTTP 500 on every unauthenticated dashboard page load when the only registered auth provider is the built-in basic (username/password) provider.

The _auto_sso_response() shortcut in the auth middleware unconditionally redirects to /auth/login?provider=<name> when exactly one provider is registered. That route calls provider.start_login(), which BasicAuthProvider doesn't implement (it's password-only, not OAuth). The resulting NotImplementedError bubbles up as an unhandled 500.

The fix adds a supports_password guard: when the sole provider is password-based, auto-SSO is skipped and the request falls through to the /login interstitial (the password form), which already works correctly.

Related Issue

Fixes #55130

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• hermes_cli/dashboard_auth/middleware.py — Add getattr(provider, "supports_password", False) check in _auto_sso_response() to skip auto-SSO for password-only providers (3 lines + comment)
• tests/hermes_cli/test_dashboard_auth_middleware.py — Add regression test test_auto_sso_skips_password_only_provider that registers a BasicAuthProvider as the sole provider and verifies / redirects to /login (password form) instead of /auth/login (OAuth initiation)

How to Test

1. Set HERMES_DASHBOARD_BASIC_AUTH_USERNAME and HERMES_DASHBOARD_BASIC_AUTH_PASSWORD environment variables
2. Launch hermes dashboard --host 0.0.0.0 with no other auth providers configured
3. Navigate to / in a browser without a session cookie
4. Before fix: HTTP 500 (NotImplementedError from BasicAuthProvider.start_login)
5. After fix: Redirect to /login showing the username/password form; login works normally
6. Run pytest tests/hermes_cli/test_dashboard_auth_middleware.py -v — all 34 tests pass (including the new regression test)

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15.2

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

[alt-glitch]

This was generated by AI during triage.

Duplicate of #54887 — same supports_password guard in the same _auto_sso_response() function (hermes_cli/dashboard_auth/middleware.py). This is the fifth identical fix for #55130; #54887 is the earliest open canonical (siblings: #54958, #55133 open; #54884 closed). The shared regression source is the merged #54846.

[liuhao1024]

This PR is a duplicate of #54887 by @sjfkai, which implements the identical supports_password guard in _auto_sso_response() and already has two LGTM reviews from @tonydwb.

Closing in favor of #54887. The test additions here could be contributed as a follow-up if needed.