Make basic auth and SSO mutually exclusive per host; fix silently-broken validation errors

- Auth tab is now a single choice (Off / Basic auth / SSO) instead of two
  independent toggles that could both be on at once, which made it
  ambiguous which gate actually protected a request. Enforced both in the
  UI and server-side (POST/PUT), accounting for partial PUT updates against
  the existing record.
- Add per-user basic-auth management (change password, delete) so an admin
  no longer has to blow away and retype the whole user list to remove or
  rotate one account.
- Fix: `Model.errors.ObjectValidateError(...)` is a constructor and was
  being called without `new` everywhere in this codebase. Without `new`,
  `this` inside it was the module's shared `errors` object (mutated in
  place) and the call evaluated to `undefined` — so every
  `throw Model.errors.ObjectValidateError(...)` actually threw `undefined`,
  which Express's `next(undefined)` treats as "no error" and silently
  falls through to the catch-all 404 handler. Every host/user/group/
  permission/dns-provider validation error (bad hostname, bad IP, etc.) was
  showing a confusing "Page not found" instead of the real message.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

nodejs/routes/render.js

@@ -19,13 +19,17 @@ const frontEndModules = ['bootstrap', 'mustache', 'jquery', '@fortawesome',
 
 // Server front end modules
 // https://stackoverflow.com/a/55700773/3140931
+// Vendor libraries only change when package versions are bumped (a rebuild),
+// so they're safe to cache aggressively; ETag/Last-Modified (on by default)
+// still cover that rare case with a cheap 304 instead of a stale asset.
 frontEndModules.forEach(dep => {
-  router.use(`/static-modules/${dep}`, express.static(path.join(__dirname, `../node_modules/${dep}`)))
+  router.use(`/static-modules/${dep}`, express.static(path.join(__dirname, `../node_modules/${dep}`), {maxAge: '7d'}))
 });
 
 // Have express server static content( images, CSS, browser JS) from the public
-// local folder.
-router.use('/static', express.static(path.join(__dirname, '../public')))
+// local folder. Shorter maxAge than /static-modules since this is the app's
+// own JS/CSS, which changes on every deploy and isn't cache-busted/fingerprinted.
+router.use('/static', express.static(path.join(__dirname, '../public'), {maxAge: '1h'}))
 
 router.get('/', (req, res) => {
   res.redirect(301, '/hosts');