Initial commit: LMS microservices scaffold

- Gradle multi-module: libs/{common-http,security-jwt,markdown,test-support},
  services/{identity,academic,progress,gateway}, web (Thymeleaf+htmx)
- identity-service: JWT auth (RSA), accounts, students, groups, enrollment,
  import from XLSX/CSV, credentials export, password reset
- academic-service: lab import from JSON/zip (markdown + YAML + variants),
  levels, API
- progress-service: schema for student levels and variant assignments
- gateway: Spring Cloud Gateway, JWT validation, route propagation
- web: Server-side UI with flex/footer layout, light/dark theme toggle,
  admin dashboard, groups CRUD, student portal placeholder
- docker-compose: PostgreSQL 18
- Tests: identity smoke test with Testcontainers

services/progress-service/src/main/kotlin/ru/ysu/lms/progress/ProgressServiceApplication.kt

@@ -0,0 +1,12 @@
+package ru.ysu.lms.progress
+
+import org.springframework.boot.autoconfigure.SpringBootApplication
+import org.springframework.boot.runApplication
+import ru.ysu.lms.security.LmsSecurityAutoConfiguration
+
+@SpringBootApplication
+class ProgressServiceApplication
+
+fun main(args: Array<String>) {
+    runApplication<ProgressServiceApplication>(*args)
+}

services/progress-service/src/main/kotlin/ru/ysu/lms/progress/domain/VariantAssignment.kt

@@ -0,0 +1,33 @@
+package ru.ysu.lms.progress.domain
+
+import jakarta.persistence.Column
+import jakarta.persistence.Entity
+import jakarta.persistence.Id
+import jakarta.persistence.Table
+import ru.ysu.lms.common.Ids
+import java.time.Instant
+import java.util.UUID
+
+@Entity
+@Table(name = "variant_assignments")
+class VariantAssignment(
+    @Id var id: UUID = Ids.v7(),
+    @Column(nullable = false) var studentId: UUID = UUID(0,0),
+    @Column(nullable = false) var labId: UUID = UUID(0,0),
+    @Column(nullable = false) var variantId: UUID = UUID(0,0),
+    @Column(nullable = false) var manual: Boolean = false,
+    @Column(nullable = false) var assignedAt: Instant = Instant.now(),
+)
+
+@Entity
+@Table(name = "student_lab_levels")
+class StudentLabLevel(
+    @Id
+    @Column(name = "student_id", insertable = false, updatable = false)
+    var studentId: UUID = UUID(0,0),
+    @Id
+    @Column(name = "lab_id", insertable = false, updatable = false)
+    var labId: UUID = UUID(0,0),
+    @Column(nullable = false) var labLevelId: UUID = UUID(0,0),
+    @Column(nullable = false) var manual: Boolean = false,
+)

services/progress-service/src/main/kotlin/ru/ysu/lms/progress/security/SecurityConfig.kt

@@ -0,0 +1,38 @@
+package ru.ysu.lms.progress.security
+
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
+import org.springframework.security.config.http.SessionCreationPolicy
+import org.springframework.security.oauth2.jwt.JwtDecoder
+import org.springframework.security.oauth2.jwt.NimbusJwtDecoder
+import org.springframework.security.web.SecurityFilterChain
+
+@Configuration
+@EnableWebSecurity
+@EnableMethodSecurity
+class SecurityConfig {
+
+    @Bean
+    fun jwtDecoder(): JwtDecoder = NimbusJwtDecoder.withJwkSetUri(JWK_URI).build()
+
+    @Bean
+    fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
+        http
+            .csrf { it.disable() }
+            .cors { it.disable() }
+            .sessionManagement { it.sessionCreationPolicy(SessionCreationPolicy.STATELESS) }
+            .authorizeHttpRequests { auth ->
+                auth.requestMatchers("/actuator/**", "/v3/api-docs/**", "/swagger-ui/**").permitAll()
+                auth.anyRequest().authenticated()
+            }
+            .oauth2ResourceServer { it.jwt { } }
+        return http.build()
+    }
+
+    companion object {
+        private val JWK_URI = System.getenv("LMS_JWT_JWK_SET_URI") ?: "http://localhost:8081/api/v1/auth/jwks.json"
+    }
+}