fix: handle password auth login redirects

[Seyferkun]

Summary

• Redirect password-capable dashboard auth providers from /auth/login to the password login page instead of invoking OAuth-only start_login()
• Preserve validated next targets and reverse-proxy X-Forwarded-Prefix on that redirect
• Route TUI pet RPC calls through the typed gateway request/result guard

Tests

• scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_password_login.py
• npm run typecheck --workspace ui-tui
• npm exec --workspace ui-tui -- eslint src/app/usePet.ts
• npm test --workspace ui-tui -- --run src/__tests__/rpc.test.ts
• git diff --check

[alt-glitch]

This was generated by AI during triage.

Related (not duplicate) to the dashboard password-only auth 500 cluster (regression from merged #54846). This PR fixes the /auth/login route (routes.py) by 302-redirecting supports_password providers to the /login page (preserving a validated next + X-Forwarded-Prefix) rather than calling OAuth-only start_login(). That is a different mechanism from:

• fix(dashboard-auth): skip auto-SSO redirect for password-only providers #54887 (canonical) — fixes _auto_sso_response in middleware.py to prevent the auto-SSO redirect entirely;
• fix: avoid 500 when password-only auth provider hits /auth/login #56666 — hardens the same /auth/login route to return a clean 400 instead of redirecting.

Complementary approaches for the same symptom; flagging the #54887 / #56666 / #57396 cluster (issues #55130, #56067) so a maintainer can pick one. Note this PR also bundles an unrelated ui-tui/src/app/usePet.ts typed-RPC-guard change.

[teknium1]

Thanks for the focused dashboard-auth fix. This is already implemented on current main; the later implementation also preserves the intended central TUI RPC guard.

Automated hermes-sweeper review evidence:

• hermes_cli/dashboard_auth/routes.py:195-202 checks supports_password, validates next, retains _prefix(request), and redirects to /login before start_login().
• tests/hermes_cli/test_dashboard_auth_password_login.py:211-217 already directly covers the password-provider /auth/login redirect.
• ui-tui/src/app/usePet.ts:197 uses the shared rpc helper; ui-tui/src/app/useMainApp.ts:450-467 validates its gateway result with asRpcResult and handles failures.
• The dashboard route and regression test landed in 3e24b16f566045399012bc1185fe0cdb6e1a1be9 (fix(dashboard): support mobile OAuth login). This aligns with the related fix(dashboard-auth): skip auto-SSO redirect for password-only providers #54887/fix: avoid 500 when password-only auth provider hits /auth/login #56666/Dashboard 500s on every page load when basic (password) auth is the only provider — auto-SSO calls start_login() on a password-only provider #55130 discussion.