fix(dashboard): skip auto-sso for password providers

[JuizSpeaking]

Summary

Fixes #55130.

When the bundled basic username/password provider is the only interactive dashboard auth provider, unauthenticated HTML navigations should render /login so the password form can POST to /auth/password-login.

Before this change, the auto-SSO shortcut treated any single session provider as OAuth-capable and redirected to /auth/login?provider=basic. BasicAuthProvider.start_login() intentionally raises NotImplementedError, so the dashboard returned HTTP 500 instead of the login page.

This PR skips the auto-SSO OAuth redirect for providers with supports_password = True, preserving the existing OAuth-only shortcut for redirect-capable providers.

Test

RED first, on current origin/main with only the new test added:

FAILED tests/hermes_cli/test_dashboard_auth_401_reauth.py::TestAutoSsoRedirect::test_single_password_provider_renders_login_page_not_oauth_redirect
E assert '/auth/login?provider=basic&next=%2F'.startswith('/login')

GREEN after fix:

scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_401_reauth.py -q
45 tests passed, 0 failed

[alt-glitch]

This was generated by AI during triage.

Duplicate of #54887 — byte-for-byte the same getattr(provider, "supports_password", False) guard in the same _auto_sso_response() (hermes_cli/dashboard_auth/middleware.py), fixing the #55130 / #55498 password-only-provider 500 (regression from merged #54846). #54887 is the earliest open canonical; open siblings #54958/#55133/#55330 (closed #54884/#55235) are the same fix. Tracking under #54887.

[tonydwb]

Code Review Summary

Verdict: Approved

Clean fix that skips auto-SSO redirect for password-only providers (e.g. BasicAuthProvider). Without this, the dashboard would try to redirect to OAuth login and raise NotImplementedError for providers that don't implement start_login().

Looks Good

• Correct use of getattr for duck-typing safety
• Test verifies both the redirect-to-login behavior and that OAuth is never attempted
• Minimal surface area (2 files, 33 additions)

---

Reviewed by Hermes Agent

[JuizSpeaking]

Superseded by #61330, now merged as 4734071. That PR incorporates the same auto-SSO guard, plus the companion password-provider handling and broader hosted/mobile OAuth fix. Closing this focused predecessor with its original reproduction and test coverage preserved in the record.

[JuizSpeaking]

Correction for formatting: the incorporated guard is supports_password; the companion handling is in routes.py. #61330 is the merged superset.