UI rework: modal dialogs, inline lab editing, manual creation, content management

- Dashboard: real stats (groups, students, labs, average grade), labs/groups
  summary lists, no placeholder tile
- Lab page: view + edit combined — metadata form in modal, condition rendered
  as markdown, per-level variant tables with add/edit/delete dialogs,
  level rename/delete, student level/variant selectors with group filter
- Labs list: create-lab dialog with manual level entry (code; title lines)
- Groups: create-group dialog, add-student dialog (auto password, toast card)
- Content: public /learn reader is the single place; admin buttons (new
  article with chapter/section create-or-select, rename/delete chapters and
  sections, move articles between sections, import zip) appear for admins;
  removed separate 'Контент' admin section
- Buttons use btn classes instead of nav-link
- Favicon: generated SVG book icon
- Security: CSRF synchronizer token interceptor (replaced spring-security in
  web which broke logback under nested jars), session regenerated on login,
  hardened session cookie, gateway actuator limited to health,info
- Jackson 3: nullable-safe request DTOs for labs (FAIL_ON_NULL_FOR_PRIMITIVES)
- academic: POST /labs (manual create with levels), level add/rename/delete,
  content chapters/sections CRUD, article create/move/delete endpoints

web/src/main/resources/templates/admin/lab-edit.html

@@ -34,6 +34,7 @@
             <textarea class="input" id="descriptionMd" name="descriptionMd" rows="14"
                       th:text="${lab.descriptionMd}"></textarea></div>
         <button class="btn btn-primary" type="submit">Сохранить</button>
+    <input type="hidden" name="_csrf" th:value="${csrfToken}">
     </form>
 
     <h2 class="section-title mt-8">Варианты</h2>
@@ -52,10 +53,12 @@
                 <div class="flex gap-2">
                     <button class="btn btn-primary" type="submit">Сохранить</button>
                 </div>
+            <input type="hidden" name="_csrf" th:value="${csrfToken}">
             </form>
             <form th:action="@{/admin/labs/{labId}/variants/{vid}/delete(labId=${lab.id}, vid=${v.id})}" method="post"
                   onsubmit="return confirm('Удалить вариант?')">
                 <button class="btn btn-secondary btn-sm" type="submit">Удалить вариант</button>
+            <input type="hidden" name="_csrf" th:value="${csrfToken}">
             </form>
         </div>
     </div>
@@ -75,6 +78,7 @@
         <div><label class="label" for="newStatement">Условие (markdown)</label>
             <textarea class="input" id="newStatement" name="statementMd" rows="6"></textarea></div>
         <button class="btn btn-primary" type="submit">Добавить</button>
+    <input type="hidden" name="_csrf" th:value="${csrfToken}">
     </form>
 </div>
 </body>