fix: generate Flask SECRET_KEY with a CSPRNG

[rodriguescarson]

Fixes #960

Problem

build_secret_key() generated the Flask SECRET_KEY like this:

return "".join(np.random.choice(list(string.ascii_uppercase + string.digits), 10))

Two issues make this weak for a signing key:

1. Non-cryptographic PRNG — np.random is a Mersenne-Twister generator, not a CSPRNG. Its output is predictable given enough observed values.
2. Low entropy — 10 characters from a 36-symbol alphabet is 36**10 ≈ 2**51.7, small enough to brute-force offline.

Flask uses SECRET_KEY to HMAC-sign session cookies, so a weak key enables session forgery / authentication bypass when auth is enabled ([auth] active = true).

Fix

Use the standard library secrets module (OS CSPRNG) with 256 bits of entropy:

return secrets.token_urlsafe(32)

Also drops the numpy and string imports from app.py, which this was their only remaining use (keeps the file flake8-clean under the repo's select = E, W, F).

Verifiable by inspection; no behavior change beyond a stronger key.

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.34%. Comparing base (d34f0a5) to head (e3322ee).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #963      +/-   ##
==========================================
- Coverage   94.34%   94.34%   -0.01%     
==========================================
  Files          59       59              
  Lines       10569    10568       -1     
==========================================
- Hits         9971     9970       -1     
  Misses        598      598              

Flag	Coverage Δ
python	94.34% <100.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
dtale/app.py	95.61% <100.00%> (-0.02%)	⬇️

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d34f0a5...e3322ee. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.