feat(dashboard-auth): define DashboardAuthProvider ABC + Session dataclass

Phase 1, Task 1.1. New package hermes_cli/dashboard_auth/ contains:

  base.py     - DashboardAuthProvider ABC with 5 abstract methods
                (start_login, complete_login, verify_session,
                refresh_session, revoke_session), Session + LoginStart
                frozen dataclasses, three exception types
                (ProviderError / InvalidCodeError / RefreshExpiredError),
                and assert_protocol_compliance() for plugins to call
                in their own tests.
  registry.py - Module-level register/get/list/clear with a lock.

Nothing reads the registry yet — Phase 2 adds the StubAuthProvider and
Phase 3 wires the gate middleware. The plugin hook lands in Task 1.3.

hermes_cli/dashboard_auth/__init__.py

@@ -0,0 +1,40 @@
+"""Dashboard authentication provider framework.
+
+The dashboard auth gate engages only when the dashboard binds to a
+non-loopback host without ``--insecure``. In that mode, every request must
+carry a verified session from one of the registered ``DashboardAuthProvider``
+plugins.
+
+The Nous provider lives in ``plugins/dashboard-auth-nous/`` and is the
+default. Third parties register their own providers via the plugin hook
+``ctx.register_dashboard_auth_provider``.
+"""
+from hermes_cli.dashboard_auth.base import (
+    DashboardAuthProvider,
+    Session,
+    LoginStart,
+    InvalidCodeError,
+    ProviderError,
+    RefreshExpiredError,
+    assert_protocol_compliance,
+)
+from hermes_cli.dashboard_auth.registry import (
+    register_provider,
+    get_provider,
+    list_providers,
+    clear_providers,
+)
+
+__all__ = [
+    "DashboardAuthProvider",
+    "Session",
+    "LoginStart",
+    "InvalidCodeError",
+    "ProviderError",
+    "RefreshExpiredError",
+    "assert_protocol_compliance",
+    "register_provider",
+    "get_provider",
+    "list_providers",
+    "clear_providers",
+]