fix: dashboard basic auth (password-only provider) no longer crashes on first page load (#57868)

[Sahil-SS9]

Fixes #57868

Description

When the dashboard is bound to a non-loopback host and the only enabled interactive auth provider is a password-only provider (e.g. the bundled plugin), unauthenticated users are redirected to , which then crashes with a 500 Internal Server Error because the basic-auth provider has no OAuth redirect flow.

The fix adds a guard in to avoid auto-redirecting to when the sole provider is password-only, falling through to render the interstitial instead.

Verification

• Applied the fix locally and verified:
  • redirects to
  • renders the password form for "Username & Password"
  • with configured credentials succeeds and sets the session cookie
  • returns the authenticated user
• All relevant tests pass (see test run in the CI)
• Quality gates passed: no secrets, no personal refs, conventional commit, focused diff, and local compilation.

[alt-glitch]

This was generated by AI during triage.

Duplicate of #54887 (earliest open canonical fix). This PR applies the same supports_password guard in _auto_sso_response() (hermes_cli/dashboard_auth/middleware.py) as #54887, one of many identical fixes in the dashboard-500 auto-SSO cluster. Related: #55130 (anchor issue), #54846 (merged regression source), #56886 (both-site superset). Maintainer to pick one; #54887 is canonical by creation time, #56886 is the broader both-code-site fix.