appsecco/dvna ? reverse-engineered prompt

Build me a small Node.js web app that deliberately demonstrates common OWASP Top 10 security issues, like the kind of training app people can use to practice finding and fixing bugs. It should have a simple login and user flow, a few different pages and routes, and a database backed setup that can run locally with Docker. I also want it to come with clear documentation that explains how to start it, how to explore the vulnerabilities, and how to fix them, so it feels like a hands on learning project.

Make it easy to run in development with live reload, and also easy to start with a single Docker command. Keep the UI simple and practical, and use common Node.js libraries for things like routing, auth, and database access. If you need to check current setup details, look up the latest docs online.