fix: redirect password dashboard auth login to login page

[BowmanStephen]

Password-capable dashboard auth providers render a credential form on /login and POST to /auth/password-login; they do not implement the OAuth redirect flow. This PR keeps OAuth providers unchanged but redirects direct /auth/login hits for password providers back to /login, preserving safe relative next paths and X-Forwarded-Prefix. Tests cover direct hits, unsafe next dropping, and prefixed deployments.

[alt-glitch]

This was generated by AI during triage.

Related: this patches the route-level facet (/auth/login redirect for password providers, routes.py only) of the dashboard password-auth 500 cluster (issue #55130, regression from #54846). The earliest open canonical fix #54887 patches the auto-SSO facet (middleware.py), and #58171 is a broader superset fixing both facets. Not a duplicate — different code-site/scope. Cross-linking so a maintainer can pick between the focused route-level fix here, the auto-SSO fix (#54887), and the combined fix (#58171).

[teknium1]

Thanks for the focused route-level fix. This is already implemented on current main.

• Automated hermes-sweeper review verified hermes_cli/dashboard_auth/routes.py:195-202: password-capable providers redirect to /login before start_login() can enter the OAuth flow; safe next values and X-Forwarded-Prefix are preserved.
• Commit 3e24b16f566045399012bc1185fe0cdb6e1a1be9 added that same branch and is an ancestor of current main.
• Current regression coverage at tests/hermes_cli/test_dashboard_auth_password_login.py:211-217 verifies a direct password-provider /auth/login request redirects to the password form.
• The prior triage comment correctly identified this as the route-level facet; current main also contains the companion password-provider auto-SSO exclusion in hermes_cli/dashboard_auth/middleware.py:211-213.