security: remediate 7 appsec findings in Flask wine app

[Copilot]

Ran a full appsec scan against wine.py and its templates. Found and patched 7 confirmed vulnerabilities spanning credential storage, session integrity, access control, and configuration hardening.

Findings & patches

Critical

• Plaintext passwords — all login/register/change_password paths now use werkzeug.security PBKDF2 hashing; existing DB record migrated
• Hardcoded secret key — replaced 'your_secret_key' with os.environ.get('FLASK_SECRET_KEY', os.urandom(32))

High

• Debug mode on — app.debug = True → False
• No password-confirmation check on register — added server-side password != confirmpw guard before INSERT

Medium

• /predict unauthenticated — added session guard; redirects to login if not authenticated
• Password fields type="text" — fixed in login.html and register.html
• Current password reflected into form value= — removed the attribute from profile.html

Additional hardening

Closed SQLite connections explicitly after every query (login and change_password routes were leaking connections).

Example: password storage before/after

# Before — plaintext stored and compared directly
cursor.execute('SELECT * FROM accounts WHERE username = ? AND password = ?', (username, password))

# After — fetch by username, verify hash out-of-band
cursor.execute('SELECT * FROM accounts WHERE username = ?', (username,))
account = cursor.fetchone()
if account and check_password_hash(account[2], password):
    ...

New tests/test_security.py adds 10 API-level tests (Flask test client + mocks) covering all 7 findings.