Redesign B3 bordeaux + finish lab-page rework

- Lab page is now read-only with a settings screen for levels/variants;
  variant issuance moved to a large modal on the group page (assign-fragment).
- Header: bordeaux logo and 2px accent underline, bordeaux login/logout/theme
  buttons; smaller radii across the UI; filled secondary/danger buttons.
- Includes prior agent work (login backoff, no-cache pages, API timeouts,
  content tweaks) and fixes (variant usage Map.values, import order).
- Bump static asset version to v=9.

web/src/main/resources/application.yml

@@ -8,6 +8,9 @@ server:
       cookie:
         http-only: true
         same-site: lax
+        # Прод работает по HTTPS (nginx + TLS); локально на http://localhost браузеры
+        # тоже принимают Secure-cookie. Отключается переменной LMS_SESSION_COOKIE_SECURE=false.
+        secure: ${LMS_SESSION_COOKIE_SECURE:true}
         max-age: 30d
       tracking-modes: cookie