Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag

archive.json is generated from the FLAG injected at startup. Find the wordlist password matching password_sha256 and XOR-decrypt with its key byte to recover the flag.
Inspect archive.json and identify the target record
find the wordlist password matching password_sha256 and XOR-decrypt with its key byte
Verify that the reconstructed value has FLAG{...} format