When running hermes dashboard --host 0.0.0.0 --port 9119 --insecure --skip-build (loopback / non-OAuth mode), the web dashboard enters an infinite full-page reload loop on every page load. The page reloads multiple times per
 second and cannot be interacted with.

 Root Cause:

 The SPA's AuthWidget component calls GET /api/auth/me on mount. In loopback mode there is no OAuth session, so request.state.session is never set. The endpoint raises HTTPException(401):

 python
 sess = getattr(request.state, "session", None)
 if sess is None:
     raise HTTPException(status_code=401, detail="Unauthorized")

 This 401 is caught by fetchJSON()'s global 401 handler in web/src/lib/api.ts, which was designed to handle stale session tokens after a server restart. Since /api/auth/me returns 401 on every request in loopback mode, the first
 API call on every page load triggers window.location.reload(), creating an infinite reload loop.

 Fix applied locally:

 1. hermes_cli/dashboard_auth/routes.py — Return null envelope (200) instead of 401 when session is None
 2. hermes_cli/web_server.py — Added /api/auth/me and /api/auth/providers to _PUBLIC_API_PATHS
 3. web/src/components/AuthWidget.tsx — Guard against null session data in loopback mode

 Expected Behavior:

 In loopback mode, the AuthWidget should either not call /api/auth/me, or the endpoint should return a non-401 response that the AuthWidget can handle gracefully (render nothing).