Fix CVE-2026-27205: upgrade Flask to ^3.1.3 (#2143)