Security hardening and dependency documentation

[he-yufeng]

Summary

• api_server.py: Disable Flask debug mode by default (was hardcoded debug=True, now controlled via FLASK_DEBUG env var) -- debug mode exposes an interactive debugger that allows arbitrary code execution
• api_server.py: Add path traversal protection on the /api/resume/file/<file_id> endpoint by validating file_id against an alphanumeric regex
• api_server.py: Set SECRET_KEY from environment variable (with random fallback) so Flask sessions use proper signing
• md_to_pdf.py: Replace os.system("pip3 install ...") with a clean error message and sys.exit(1) -- running shell commands to install packages at runtime is a security anti-pattern
• requirements.txt: Document optional dependencies (selenium, webdriver-manager, markdown, reportlab) as comments so users know what to install for specific features

Test plan

• Verify CI passes (ruff lint)
• Verify api_server.py starts normally with python api_server.py
• Verify debug mode is off by default, can be enabled with FLASK_DEBUG=1
• Verify md_to_pdf.py exits cleanly when markdown/reportlab not installed

Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com