fix: Disable Flask debug mode by default (Security Alert #2)

- Change debug=True to debug=False by default
- Add FLASK_DEBUG environment variable for development
- Show warning when debug mode is enabled
- Prevents arbitrary code execution via Werkzeug debugger
- Fixes GitHub Security Alert #2 (py/flask-debug)

Production deployments are now secure by default.
For development: export FLASK_DEBUG=1

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

web/dashboard_api.py

@@ -313,5 +313,15 @@ if __name__ == '__main__':
     print(f"Starting server on http://localhost:5000")
     print(f"API Docs: http://localhost:5000/")
     print("="*60)
+
+    # Security fix: Disable debug mode in production
+    # Debug mode allows arbitrary code execution via Werkzeug debugger
+    # For development only: Set FLASK_DEBUG=1 environment variable
+    import os
+    debug_mode = os.getenv("FLASK_DEBUG", "0") == "1"
     
-    app.run(host='0.0.0.0', port=5000, debug=True)
+    if debug_mode:
+        print("\n⚠️  WARNING: Running in DEBUG mode (development only!)")
+        print("   Do NOT use in production - allows arbitrary code execution!\n")
+    
+    app.run(host='0.0.0.0', port=5000, debug=debug_mode)