GHSA-r7v3-x45f-g7hp: PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated

PraisonAI's `praisonai serve agents` command accepts an `--api-key` flag that claims to enable authentication, but the code that creates the HTTP server never actually uses this key. This means anyone on the network can invoke agents through the `POST /agents` and `POST /agents/{agent_name}` routes without providing any credentials, even though the operator thought they were securing the service. The problem is made worse because a working authentication function already exists in the same codebase (called `verify_token`, which guards other API routes), but it is simply not applied to these agent-invocation routes.