feat(lab2): Threagile threat model + secure variant + auth flow bonus

[Meliman1000-7]

Goal

Generate a STRIDE-based threat model of OWASP Juice Shop with Threagile, produce a secure variant, and diff the risk reports.

Changes

• submissions/lab2.md — baseline risk analysis, secure variant diff, auth flow bonus
• labs/lab2/threagile-model-secure.yaml — hardened variant (HTTPS, encryption, auth on internal links)
• labs/lab2/threagile-model-auth.yaml — focused auth flow model (written from scratch)

Testing

• docker run ... threagile-model.yaml → risks.json generated (23 risks: 4 elevated, 14 medium, 5 low)
• docker run ... threagile-model-secure.yaml → 18 risks (3 elevated fixed, 2 medium fixed)
• docker run ... threagile-model-auth.yaml → 41 risks (1 high, 12 elevated — auth-specific)

Artifacts & Screenshots

• submissions/lab2.md
• labs/lab2/threagile-model-secure.yaml
• labs/lab2/threagile-model-auth.yaml

Checklist

• Title is clear (feat(lab2): Threagile threat model + secure variant + auth flow bonus)
• No secrets or large temp files committed
• Submission file at submissions/lab2.md exists

---

• Task 1 done — Baseline risk table + top-5 with STRIDE mapping
• Task 2 done — Secure variant + risk diff table
• Bonus done — Auth-flow model + 3 auth-specific risks