Add PULSE_AUTH_HIDE_LOCAL_LOGIN option to hide password form

Implements #750 - allows hiding the username/password login form when
using OIDC SSO to avoid user confusion, while maintaining security.

- Added HideLocalLogin config option (env: PULSE_AUTH_HIDE_LOCAL_LOGIN)
- Exposed hideLocalLogin in /api/security/status endpoint
- Updated Login.tsx to conditionally hide local login form
- Added escape hatch via ?show_local=true URL parameter

This approach avoids the security and upgrade issues that led to
DISABLE_AUTH being removed (see #707, #678), while solving the UX
problem of users being confused by multiple login options.

frontend-modern/src/components/Login.tsx

@@ -20,6 +20,7 @@ interface SecurityStatus {
   deprecatedDisableAuth?: boolean;
   message?: string;
   apiTokenConfigured?: boolean;
+  hideLocalLogin?: boolean;
 }
 
 export const Login: Component<LoginProps> = (props) => {
@@ -275,6 +276,12 @@ export const Login: Component<LoginProps> = (props) => {
   const showFirstRunSetup = () =>
     authStatus()?.hasAuthentication === false || legacyDisableAuth();
 
+  const shouldShowLocalLogin = () => {
+    const params = new URLSearchParams(window.location.search);
+    if (params.get('show_local') === 'true') return true;
+    return !authStatus()?.hideLocalLogin;
+  };
+
   return (
     <Show
       when={!loadingAuth()}
@@ -306,6 +313,7 @@ export const Login: Component<LoginProps> = (props) => {
               oidcLoading,
               oidcError,
               oidcMessage,
+              showLocalLogin: shouldShowLocalLogin(),
             }}
           />
         }
@@ -346,6 +354,7 @@ const LoginForm: Component<{
   oidcLoading: () => boolean;
   oidcError: () => string;
   oidcMessage: () => string;
+  showLocalLogin: boolean;
 }> = (props) => {
   const {
     username,
@@ -362,6 +371,7 @@ const LoginForm: Component<{
     oidcLoading,
     oidcError,
     oidcMessage,
+    showLocalLogin,
   } = props;
 
   return (
@@ -443,6 +453,7 @@ const LoginForm: Component<{
               </p>
             </div>
           </Show>
+          <Show when={showLocalLogin}>
             <div class="space-y-4">
               <div class="relative">
                 <label for="username" class="sr-only">
@@ -606,6 +617,7 @@ const LoginForm: Component<{
                 </Show>
               </button>
             </div>
+          </Show>
         </form>
       </div>
     </div>

internal/api/router.go

@@ -486,6 +486,7 @@ func (r *Router) setupRoutes() {
 				"authUsername":                "",
 				"authLastModified":            "",
 				"oidcUsername":                oidcUsername,
+				"hideLocalLogin":              r.config.HideLocalLogin,
 			}
 
 			if isAuthenticated {

internal/config/config.go

@@ -129,6 +129,7 @@ type Config struct {
 	DemoMode               bool             `envconfig:"DEMO_MODE" default:"false"` // Read-only demo mode
 	AllowedOrigins         string           `envconfig:"ALLOWED_ORIGINS" default:"*"`
 	IframeEmbeddingAllow   string           `envconfig:"IFRAME_EMBEDDING_ALLOW" default:"SAMEORIGIN"`
+	HideLocalLogin         bool             `envconfig:"PULSE_AUTH_HIDE_LOCAL_LOGIN" default:"false"`
 
 	// Proxy authentication settings
 	ProxyAuthSecret        string `envconfig:"PROXY_AUTH_SECRET"`
@@ -774,6 +775,16 @@ func Load() (*Config, error) {
 		}
 	}
 
+	if hideLocalLoginStr := utils.GetenvTrim("PULSE_AUTH_HIDE_LOCAL_LOGIN"); hideLocalLoginStr != "" {
+		if hide, err := strconv.ParseBool(hideLocalLoginStr); err == nil {
+			cfg.HideLocalLogin = hide
+			cfg.EnvOverrides["PULSE_AUTH_HIDE_LOCAL_LOGIN"] = true
+			log.Info().Bool("hide", hide).Msg("Overriding hide local login setting from environment")
+		} else {
+			log.Warn().Str("value", hideLocalLoginStr).Msg("Invalid PULSE_AUTH_HIDE_LOCAL_LOGIN value, ignoring")
+		}
+	}
+
 	if enabledStr := utils.GetenvTrim("ENABLE_BACKUP_POLLING"); enabledStr != "" {
 		switch strings.ToLower(enabledStr) {
 		case "0", "false", "no", "off":