The lab was crashing when a vulnerability scanner hit it because every
servlet leaks its DB connection (no close), and DBConnect opens a fresh
DriverManager connection per request. Under load the JVM accumulated
leaked connections until it OOMed and MySQL hit max_connections=151.

Fix at the pool layer so no servlet/controller code changes (all
deliberate vulnerabilities preserved):

- Declare a tomcat-jdbc DataSource at jdbc/jvl in META-INF/context.xml
  with maxActive=50 and removeAbandoned=true (60s) so leaked connections
  are auto-reaped.
- Add resource-ref in web.xml.
- Make DBConnect.connect look up the pool via JNDI, with the original
  DriverManager path retained as a fallback.
- Copy mysql-connector-java into Tomcat's shared lib/ so the pool's
  container classloader can load the driver.
- Bump CATALINA_OPTS to -Xms256m -Xmx1024m.
- Set MySQL max_connections=500 and shorter wait_timeout/interactive_timeout.
- Add .dockerignore (mysql-data/, .git/, target/) and .gitignore.

Verified: 200 concurrent SQLi requests cap MySQL Threads_connected at
50 with Aborted_connects=0; SQLi auth bypass on /LoginValidator still
works.

Realign the lab with the 2025 Top 10 categories and add the challenges the
new list needs.

New vulnerability pages:
- A01: JWT claim tampering (unverified signature), SSRF URL preview
- A02: directory listing on /backup/, debug mode error page
- A03: Log4Shell via log4j 2.12.1
- A05: OS command injection (ping)
- A06: unrestricted file upload, client-side OTP step-up bypass
- A07: hard-coded API keys in front-end JS, session ID in URL handoff
- A08: insecure Java deserialization, third-party script with no SRI
- A09: log injection in the audit trail
- A10: fail-open access check, incomplete rollback on wallet transfer

Supporting changes:
- rebuild the nav menu around the 2025 categories and drop dead links
- add balance column and a mule account to the seed data
- add a debug toggle to admin config and a widget source admin screen
- serve session-tracked URLs through response.encodeURL()
- rework xxe.jsp into an editable XML import form
- enable EL on xslt.jsp so the stylesheet parameter is reachable
- raise the JSP buffer on pages.jsp so the stack trace is not truncated
- restyle the site and add favicons

- correct the docker setup URL to port 9080
- drop the obsolete JDBC URL step, install.jsp already defaults to mysql:3306
- document the seeded accounts and the full Top 10 2025 challenge mapping
- mark the VM, JAR and WAR methods as outdated and collapse them
- scope the warning to internet exposure rather than local docker use