LocxZ/SecureSDLC-Lab ? reverse-engineered prompt

Build me a simple Node.js web app for learning Secure SDLC, with a basic login system, a normal user page, and an admin only page.

I want it to use SQLite for storing users, with passwords hashed using bcrypt, session based authentication, secure cookies, session regeneration after login, and basic role based access so only admins can open the admin area. Please add common security headers too, and make sure the login uses parameterized queries so it is not vulnerable to SQL injection.

Also set it up so it can run in Docker and in Kubernetes, with safer defaults like running as a non root user and locking things down a bit. Add a GitHub Actions workflow that runs security checks on every push and pull request, including secret scanning, code scanning, dependency and container scanning, Kubernetes manifest checks, and a web app security test. If anything needs current tool docs, look them up online. Keep the app simple and focused on security learning, not a big feature set.