.htpasswd in template file
It's not doing it due to order of operations. Your browser hits the site, checks htaccess (in the webroot /html/), and then asks craft for whatever page. Craft goes hunting around, and returns your page from templates. And it's Craft (not you the user) accessing the templates, so it's always 'approved.'

Here's a potential solution. Take a look at this page - https://noahread.net/blog/create-password-protected-pages-in-craft

It's how to create a single password-protected page. Uses a for a password. And that password is hidden in a craft variable, so no one can see it. If it returns successfully, you get content.

All that said, craft pro might be cheaper than the time spent building said form.