Make basic auth and SSO mutually exclusive per host; fix silently-broken validation errors

- Auth tab is now a single choice (Off / Basic auth / SSO) instead of two
  independent toggles that could both be on at once, which made it
  ambiguous which gate actually protected a request. Enforced both in the
  UI and server-side (POST/PUT), accounting for partial PUT updates against
  the existing record.
- Add per-user basic-auth management (change password, delete) so an admin
  no longer has to blow away and retype the whole user list to remove or
  rotate one account.
- Fix: `Model.errors.ObjectValidateError(...)` is a constructor and was
  being called without `new` everywhere in this codebase. Without `new`,
  `this` inside it was the module's shared `errors` object (mutated in
  place) and the call evaluated to `undefined` — so every
  `throw Model.errors.ObjectValidateError(...)` actually threw `undefined`,
  which Express's `next(undefined)` treats as "no error" and silently
  falls through to the catch-all 404 handler. Every host/user/group/
  permission/dns-provider validation error (bad hostname, bad IP, etc.) was
  showing a confusing "Page not found" instead of the real message.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

nodejs/models/dns_provider.js

@@ -176,7 +176,7 @@ class DnsProvider extends Table{
 				for(let key in Provider._keyMap){
 					keys.push({'key': key, message: 'Invalid Key'})
 				}
-				throw this.errors.ObjectValidateError(keys, "API rejected key");
+				throw new this.errors.ObjectValidateError(keys, "API rejected key");
 			}
 			// Don't swallow other failures (e.g. a domain-sync validation error):
 			// returning undefined here made the route crash on `item.id` with an

nodejs/models/host.js

@@ -189,7 +189,7 @@ class Host extends Table{
 		}catch(error){
 			console.log('validateWildcardCreate error', error)
 			if(error.status === 404) error.message = "No matching DNS provider registered"
-			throw this.errors.ObjectValidateError([{key: 'host', message: error.message}]);
+			throw new this.errors.ObjectValidateError([{key: 'host', message: error.message}]);
 		}
 	}
 

nodejs/models/local_group.js

@@ -30,7 +30,7 @@ class LocalGroup extends Table{
 	static async create(data){
 		data.name = this.slug(data.name);
 		if(!data.name){
-			throw this.errors.ObjectValidateError([{key: 'name', message: 'A group name is required.'}]);
+			throw new this.errors.ObjectValidateError([{key: 'name', message: 'A group name is required.'}]);
 		}
 		if(!Array.isArray(data.members)) data.members = [];
 		return super.create(data);
@@ -39,7 +39,7 @@ class LocalGroup extends Table{
 	async addMember(username){
 		username = String(username || '').trim();
 		if(!username){
-			throw this.constructor.errors.ObjectValidateError([{key: 'username', message: 'A username is required.'}]);
+			throw new this.constructor.errors.ObjectValidateError([{key: 'username', message: 'A username is required.'}]);
 		}
 		let members = Array.isArray(this.members) ? this.members : [];
 		if(members.includes(username)) return this;

nodejs/models/permission.js

@@ -55,10 +55,10 @@ class Permission extends Table{
 
 	static async create(data){
 		if(!this.roles.includes(data.role)){
-			throw this.errors.ObjectValidateError([{key: 'role', message: `role must be one of ${this.roles.join(', ')}`}]);
+			throw new this.errors.ObjectValidateError([{key: 'role', message: `role must be one of ${this.roles.join(', ')}`}]);
 		}
 		if(!['user', 'group'].includes(data.subjectType)){
-			throw this.errors.ObjectValidateError([{key: 'subjectType', message: `subjectType must be 'user' or 'group'`}]);
+			throw new this.errors.ObjectValidateError([{key: 'subjectType', message: `subjectType must be 'user' or 'group'`}]);
 		}
 		if(data.scope === 'global') data.domain = '*';
 		data.id = this.mkId(data);