This helps immensely. My server.xml and your's are completely different where it counts.

I should disclose my apache-tomcat 8.5.6 is delivered as part of apache-tomee 7.0.2, but I would hope that shouldn't make a difference.

I started with:

<Realm className="org.apache.catalina.realm.LockOutRealm">
	<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
		resourceName="UserDatabase"/>
</Realm>

and after researching, I changed to:

<Realm className="org.apache.catalina.realm.LockOutRealm">
	<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
		digest="SHA-256" resourceName="UserDatabase"/>
</Realm>

Which totally didn't work... You have:

<Realm className="org.apache.catalina.realm.LockOutRealm">
	<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase">
		<CredentialHandler className="org.apache.catalina.realm.MessageDigestCredentialHandler" algorithm="SHA-256" />
	</Realm>
</Realm>

...which includes the entire CredentialHandler part... I can't figure out where I should have known this was supposed to go in.

I changed my server.xml to look like your's above and now it works great! Thank you so much for your help, and I'm sorry this was so much trouble.