Rooted. That was intense. The foothold was a killer. user2->user3 was annoying, as I had the correct files right in front of me, but missed it for a couple of days due to not using the right commands to view them. That was a ‘duh’ moment when I finally figured it out.
Thank you @MinatoTW and @egre55 for an amazing machine. This one felt very “realistic” in terms of the steps it took to get to root. All along the way I never felt like “oh, this is just contrived for the challenge”.
Edit: I forgot to add, thanks to @MariaB for the link on bypassing the WAF. Much appreciated, it was exactly what I needed.