Fix auto-SSO redirect for password-only auth providers

[joe-bader]

Summary:

• send password-capable auth providers to /login instead of /auth/login
• preserve next= correctly for both /login and /auth/login URLs
• add password-provider regression tests for the auto-redirect path

Problem:
When only a password provider (for example basic auth) is configured, the dashboard auto-SSO gate redirects unauthenticated HTML requests to /auth/login?provider=. Password providers do not implement the OAuth redirect flow, so that path raises NotImplementedError and returns a 500.

Fix:
Detect supports_password providers in the gate and redirect them to /login instead. Also build the next query parameter with the correct separator so /login gets ?next=... while OAuth providers keep &next=....

Test plan:

• ./venv/bin/python -m pytest tests/hermes_cli/test_dashboard_auth_password_login.py tests/hermes_cli/test_dashboard_auth_401_reauth.py -q
• manually verified the dashboard login works again with basic auth on 0.0.0.0:9119

[alt-glitch]

This was generated by AI during triage.

Duplicate of #54887 — same fix at the same _auto_sso_response code-site (hermes_cli/dashboard_auth/middleware.py) for the password-only dashboard-auth 500 (issue #55130, regression from merged #54846). #54887 is the earliest open canonical fix. This variant rewrites the redirect to /login rather than returning None. Related: #58171 (broader superset fixing both middleware auto-SSO and the /auth/login route) and #59268 (routes.py facet).

[teknium1]

Thanks for the focused reproduction and regression tests. This is an automated hermes-sweeper review; current main already provides this password-provider auto-SSO protection.

• hermes_cli/dashboard_auth/middleware.py:212-213 returns to the normal /login fallback for supports_password providers; the fallback at :310-313 preserves the normal next= behavior.
• hermes_cli/dashboard_auth/routes.py:195-202 also redirects password providers away from /auth/login while preserving validated next=.
• Commit 3e24b16f566045399012bc1185fe0cdb6e1a1be9 added the production behavior and the equivalent regression coverage in tests/hermes_cli/test_dashboard_auth_password_login.py:201-217.

Closing as implemented on main.