CSPF-Founder/JavaVulnerableLab ? reverse-engineered prompt

Build me this Java web security lab so I can run it locally with Docker and explore the different broken features in a browser.

I want a simple Tomcat based web app with a setup page first, then a main home page with a Vulnerability menu that groups the exercises by security category. It should have lots of intentionally insecure examples, like bad login handling, SQL injection, XSS, file upload problems, access control mistakes, weak crypto, and a few other common web app flaws, and each page should include a short comment explaining what the bug is and how it should be fixed.

Make it work with MySQL, keep the database data around between restarts, and expose the app on port 9080 so it does not clash with anything else. Please include clear install steps and a few default test accounts so I can jump in quickly. This is for local learning only, so keep the setup easy to run with docker compose and make sure it is obvious that it should never be exposed publicly.