security: API hardening and dependency vulnerability reduction (rescan 2026-03-08)

[lhy8888]

Summary

This PR applies security fixes identified during a deep rescan:

• remove shell execution pattern in translation CLI and validate language argument
• disable legacy weak auth/hash compatibility by default (MD5/SHA1/plaintext fallback)
• switch deprecated Crypto import path to Cryptodome
• upgrade vulnerable Python runtime dependencies in requirements.txt and Pipfile

Security scan delta

• Bandit HIGH: 6 -> 0
• pip-audit: 30 -> 14

Commits

• 5f0137d security(api): remove shell injection and disable legacy weak auth hashes by default
• 68ce5d3 security(deps): upgrade vulnerable Python packages in api runtime

Notes

Remaining 14 vulnerabilities are concentrated in framework-level major upgrades (Flask/Werkzeug/urllib3/flask-cors) and should be handled in a dedicated compatibility PR.

[lhy8888]

Linked fix for this runtime white-screen bug is included in commit 2dd019c47 on this PR. Closes #770

[lhy8888]

Added built-in model bootstrap command in commit 4b7fcfe4a to resolve this deployment issue. Closes #771