Moscow-time date display, CSRF error UX, session cookie hardening

- DateUtils: format ISO instants as dd.MM.yyyy HH:mm in Europe/Moscow
- admin/lab page and student dashboard show deadlines in MSK time
- CSRF failure redirects to /login with friendly message instead of 403
- session tracking-modes=cookie (no ;jsessionid in URLs) (previously set)
- web rebuild with all dialog/status-toggle fixes verified end-to-end

web/src/main/resources/templates/admin/lab.html

@@ -13,8 +13,8 @@
                     <input type="hidden" name="_csrf" th:value="${csrfToken}">
                     <button class="btn btn-secondary btn-sm ml-2" onclick="return confirm('Сменить статус лабораторной?')" type="submit">Сменить статус</button>
                 </form>
-                <span th:if="${lab.deadlineAt != null}"> · Срок: <span th:text="${lab.deadlineAt}"></span></span>
-                <span th:if="${lab.defenseAt != null}"> · Защита: <span th:text="${lab.defenseAt}"></span></span>
+                <span th:if="${deadlineMsk != null}"> · Срок: <span th:text="${deadlineMsk} + ' МСК'"></span></span>
+                <span th:if="${defenseMsk != null}"> · Защита: <span th:text="${defenseMsk} + ' МСК'"></span></span>
                 · Максимум: <span th:text="${lab.pointsMax}"></span> б.
             </p>
         </div>