Initial commit: Imperva WAF demo lab

Flight-booking app scaffolded from the source running on the GCP host,
plus the four-screen frontend and three OWASP attack endpoints (SQLi,
reflected XSS, path traversal) built and locally verified against a
live uvicorn/vite dev pair. Includes deploy.sh (local build -> ship
over ssh -> swap on host) and docs/ carried over from the handoff.

imperva-proxy/Caddyfile

@@ -0,0 +1,15 @@
+{
+	auto_https off
+}
+
+:443 {
+	tls /etc/caddy/certs/origin.crt /etc/caddy/certs/origin.key
+
+	handle /api/* {
+		reverse_proxy host.containers.internal:8000
+	}
+
+	handle {
+		reverse_proxy host.containers.internal:8080
+	}
+}