Fix BasicAuth dashboard authentication redirect

[leveragingmaven]

Fixes the dashboard login flow when BasicAuthProvider is the only configured provider.

Changes:

• Skip OAuth redirect for password-only providers.
• Return HTTP 400 instead of HTTP 500 when a provider does not implement OAuth login.

This prevents the dashboard from redirecting BasicAuth users into an unsupported OAuth flow.

[alt-glitch]

This was generated by AI during triage.

Duplicate of #54887 — the middleware.py change here is the same supports_password early-return in _auto_sso_response as the canonical open fix #54887 (into which #54958/#55133/#56306/#56639/#57402/#57797/#57214/#57927 already dedup). The extra routes.py NotImplementedError→400 handler mirrors #55988's route-level guard. Related: anchor issue #55130, #55988, and the regression source #54846. Marking as duplicate; maintainer to pick the canonical fix.

[teknium1]

Thanks for the focused dashboard-auth fix. This is now implemented on current main; this is an automated hermes-sweeper review.

• Commit 3e24b16f566045399012bc1185fe0cdb6e1a1be9 added the password-provider exclusion in hermes_cli/dashboard_auth/middleware.py:212, so a sole password provider falls through to /login rather than entering the OAuth redirect path.
• The same commit hardens direct/stale requests in hermes_cli/dashboard_auth/routes.py:195-202 by redirecting password providers to the validated /login target before start_login() can raise.
• tests/hermes_cli/test_dashboard_auth_password_login.py:201-217 covers both affected entry points.
• This matches the duplicate triage discussion pointing to fix(dashboard-auth): skip auto-SSO redirect for password-only providers #54887 and fix(dashboard): guard auth_login against password-only providers to prevent NotImplementedError crash #55988.