fix(dashboard): guard auth_login against password-only providers to prevent NotImplementedError crash

[liuhao1024]

What does this PR do?

Fixes a crash in the dashboard auth login route when a password-only provider (BasicAuthProvider) is accessed via /auth/login?provider=basic. The route unconditionally calls p.start_login() which raises NotImplementedError for password-only providers, crashing the ASGI server and causing the container to enter a restart loop.

The fix adds a guard that rejects password-only providers with a 400 response before attempting the OAuth redirect flow.

Related Issue

Fixes #55985

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• hermes_cli/dashboard_auth/routes.py: Added a supports_password guard in auth_login() that returns HTTP 400 for password-only providers, preventing the unhandled NotImplementedError from reaching the ASGI top level.
• tests/hermes_cli/test_dashboard_auth_middleware.py: Added test_login_password_only_provider_returns_400_not_500 regression test that registers a BasicAuthProvider and verifies /auth/login?provider=basic returns 400 with a descriptive error message.

How to Test

1. Run python -m pytest tests/hermes_cli/test_dashboard_auth_middleware.py -v — all 34 tests should pass, including the new test_login_password_only_provider_returns_400_not_500.
2. Manual: start the dashboard with basic auth, navigate to /auth/login?provider=basic — should return 400 JSON error instead of 500 crash.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 26.4.1

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

[alt-glitch]

This was generated by AI during triage.

Related: this fixes the same NotImplementedError crash family (password-only BasicAuthProvider → start_login()) as #55130/#55498 and PRs #54887/#54958 — but at a different code site. The #55130-family guards _auto_sso_response in the middleware; this PR guards the /auth/login route directly (routes.py:192), which is the path hit by the logout redirect (#55985) that the middleware guard doesn't cover. Broader-scope route-level fix, not a duplicate. A maintainer should decide whether both guards are wanted.

[teknium1]

Thanks for identifying the direct /auth/login crash path. This is now covered on current main by a later route-level fix, with behavior that preserves the password-login flow.

• Automated hermes-sweeper review verified hermes_cli/dashboard_auth/routes.py:195-202: password providers are redirected to /login before start_login() at line 205 can execute.
• tests/hermes_cli/test_dashboard_auth_password_login.py:211-217 verifies /auth/login?provider=testpw redirects to the password form.
• This was implemented by 3e24b16f566045399012bc1185fe0cdb6e1a1be9 (fix(dashboard): support mobile OAuth login), which is present in current main.
• The prior triage comment correctly identified this as a distinct route-level path; the later implementation resolves that path without rejecting a valid password-login navigation.