fix: keep password dashboard auth on login form

[Dalvae]

Summary

• avoid auto-SSO OAuth redirect when the only dashboard auth provider supports password login
• keep password-only/basic auth on the /login form instead of hitting /auth/login and 500ing
• add regression coverage for the single password-provider path

Test

• uv run --with pytest --with fastapi --with starlette --with httpx python -m pytest tests/hermes_cli/test_dashboard_auth_password_login.py -q

[alt-glitch]

This was generated by AI during triage.

Duplicate of #54887 — same code site (_auto_sso_response in hermes_cli/dashboard_auth/middleware.py) and same mechanism (if getattr(provider, "supports_password", False): return None fall-through to the /login form). #54887 is the earliest open fix in the dashboard password-auth 500 cluster (regression from merged #54846). Related: #58171 (broader superset), #59268 (routes.py facet).