CVE-2026-47393: PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (praisonai.deploy.api.generate_api_server_code) that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart (praisonai deploy --type api) get a server that:

• binds to 0.0.0.0 per the recommended sample YAML
• exposes /chat and /agents endpoints
• runs praisonai.run() on user-supplied JSON input — LLM orchestration with the API key materials present in the process environment
• does not require any authentication

The PyPI wheel praisonai==4.6.33 (current @latest) still ships the generator with auth_enabled defaulting to False. The fix shape is opt-in via APIConfig(auth_enabled=True, auth_token=...).