LAN/local dashboard access requires password after June 2026 auth hardening

[911pcdoc-ui]

Description

After enabling non-loopback dashboard binds, the June 2026 hardening now forces LDAP/basic auth even on purely local networks. Previously, --insecure allowed passwordless LAN access; that path is now effectively gone.

When dashboard.basic_auth is blanked, /auth/login?provider=basic returns 500 instead of failing cleanly or allowing local-network bypass, which breaks trusted-home usage.

Steps to reproduce

1. Install Hermes on a LAN host.
2. Run hermes dashboard --host 0.0.0.0 --port 9121.
3. Observe auth is required on 192.168.x.x:9121.
4. Blank dashboard.basic_auth in config.yaml.
5. Access /auth/login?provider=basic → 500 Internal Server Error.

Environment

• Hermes version: 0.18.0 80a774f9
• OS: Linux 6.17.0-35-generic x86_64
• Python: 3.11.11
• Provider: nous
• Dashboard bind: non-loopback LAN access desired from multiple local devices / iPad

Request

Provide a supported no-password or local-trust mode for LAN-only dashboard usage, or restore a documented escape hatch for trusted internal networks.

[alt-glitch]

This was generated by AI during triage.

Duplicate of #55130 — same crash: with a sole password-only basic-auth provider on a non-loopback bind, _auto_sso_response() 302-redirects to /auth/login?provider=basic, which calls provider.start_login(); BasicAuthProvider raises NotImplementedError and it surfaces as HTTP 500. Fix is tracked by #54887 (skip the auto-SSO shortcut for password-only providers). Note: the passwordless-LAN --insecure escape hatch was intentionally removed — --insecure is now a no-op and a public/LAN bind always requires an auth provider (#50476).