The FYI for those interested is that cwpsrv runs under Nginx, not Apache -- so syntax for configuration changes needs to be appropriate for Nginx. And thus, .htaccess files are not read or considered.
Also, in order to preserve files through CWP updates, you need to set the immutable bit:
chattr +i /usr/local/cwpsrv/htdocs/.htpasswd