Why Kali comes later
Kali bundles tools for network pentesting, wireless, forensics. Web AppSec fundamentals need a browser, not nmap. Install Kali when you move to OS-level boxes.
What replaces Kali for web labs
Cyfotok hosts vulnerable apps. Browser DevTools replace Burp for basics. Online compilers for scripting practice.
When to install Kali
After 30+ web labs when starting HTB/TryHackMe machine rooms requiring nmap, gobuster, metasploit.