Moscow-time date display, CSRF error UX, session cookie hardening

- DateUtils: format ISO instants as dd.MM.yyyy HH:mm in Europe/Moscow
- admin/lab page and student dashboard show deadlines in MSK time
- CSRF failure redirects to /login with friendly message instead of 403
- session tracking-modes=cookie (no ;jsessionid in URLs) (previously set)
- web rebuild with all dialog/status-toggle fixes verified end-to-end

web/src/main/resources/application.yml

@@ -5,6 +5,7 @@ server:
       cookie:
         http-only: true
         same-site: lax
+      tracking-modes: cookie
 
 spring:
   application: