API service defaults to debug mode while binding to 0.0.0.0

[WaterRainting]

Summary

The default API service configuration starts Flask in debug mode and binds to all interfaces unless users override the environment.

Affected code

• .env.example: FLASK_DEBUG=True
• src/microworld/config/settings.py: DEBUG = os.environ.get("FLASK_DEBUG", "True").lower() == "true"
• src/microworld/cli/api.py: host = os.environ.get("FLASK_HOST", "0.0.0.0")

Why this matters

A new user following the README can expose a debug Flask service on all network interfaces by default. That is not a safe default for a backend that uses API keys and local files.

Expected behavior

The default should be local-development safe:

• FLASK_DEBUG=False unless explicitly enabled
• FLASK_HOST=127.0.0.1 unless explicitly changed

Suggested fix

Set safe defaults in code and .env.example, and document how to opt into remote binding/debug mode for development.