Initial commit: Imperva WAF demo lab

Flight-booking app scaffolded from the source running on the GCP host,
plus the four-screen frontend and three OWASP attack endpoints (SQLi,
reflected XSS, path traversal) built and locally verified against a
live uvicorn/vite dev pair. Includes deploy.sh (local build -> ship
over ssh -> swap on host) and docs/ carried over from the handoff.

frontend/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "imperva-demo-frontend",
+  "scripts": { "dev": "vite", "build": "vite build" },
+  "dependencies": { "vue": "^3.4.0" },
+  "devDependencies": { "vite": "^5.2.0", "@vitejs/plugin-vue": "^5.0.0" }
+}