fix: skip auto-SSO redirect for password-only auth providers

[Stoltemberg]

What does this PR do?

_auto_sso_response() unconditionally redirects to /auth/login when there is exactly one session provider. For password-only providers (e.g. BasicAuthProvider), /auth/login calls start_login() which raises NotImplementedError → 500 Internal Server Error.

Fix: check provider.supports_password before redirecting. If True, return None to let the /login interstitial render the credential form.

Related Issue

Fixes #56067

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• hermes_cli/dashboard_auth/middleware.py: Added guard in _auto_sso_response() to skip auto-redirect when the sole provider is password-only.

How to Test

1. Configure dashboard with only a basic auth provider
2. Visit http://host:9119/ in browser
3. Should render /login with credential form (not 500)

Checklist

• ruff check passes
• Fixes Dashboard 500 on password-only auth provider: _auto_sso_response redirects to /auth/login instead of /login #56067
• No new dependencies

[alt-glitch]

This was generated by AI during triage.

Duplicate of #54887 (earliest open canonical) — this is the sixth identical supports_password guard in _auto_sso_response() (hermes_cli/dashboard_auth/middleware.py) fixing the password-only-provider 500. Same mechanism as open siblings #54958, #55133 and closed #54884, #55235. Fixes the same regression from merged #54846. Related to the target issue #56067.

[teknium1]

Implemented on current main by automated hermes-sweeper review.

• Commit 3e24b16f566045399012bc1185fe0cdb6e1a1be9 adds the same password-provider guard at hermes_cli/dashboard_auth/middleware.py:190, returning to /login instead of auto-starting OAuth.
• The same commit protects the direct sibling route at hermes_cli/dashboard_auth/routes.py:195, redirecting password providers to /login before start_login().
• Regression coverage at tests/hermes_cli/test_dashboard_auth_password_login.py:201 verifies the root request reaches the password form, and the adjacent test covers direct /auth/login.
• This matches the prior duplicate discussion pointing to canonical PR fix(dashboard-auth): skip auto-SSO redirect for password-only providers #54887, which was later closed as superseded.