Vulnerability-scanner test site

A small CRUD app backed by an isolated MariaDB instance.

The DB account is least-privilege (DML only, scoped to testsite).

• Products — list & search
• Users — directory
• Guestbook — read & post
• /health — JSON health check