Interactive Istio service mesh lab. Six scenarios cover mesh-wide STRICT mTLS rollout failures (PERMISSIVE-first migration), AuthorizationPolicy ALLOW-with-empty-rules anti-pattern, RequestAuthentication that does not actually require JWTs, VirtualService route ordering and broken canaries, retry-storm amplification of brownouts, and istioctl proxy-config diagnostics for missing endpoints.