GHSA-v2f8-6655-7grj: Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

Vibe-Trading's FastAPI server has five security flaws that allow attackers to execute commands as root without authentication. The main issue is that the authentication key (`API_AUTH_KEY`) is commented out by default, causing the `require_auth()` function to return immediately without checking credentials, leaving all endpoints unprotected. Additionally, the FastAPI process runs as root (uid=0) inside the container, and the server listens on all network interfaces (0.0.0.0:8899), so any remote attacker can send commands to the LLM agent, which will execute them as shell commands with root privileges.