Initial commit: LMS microservices scaffold

- Gradle multi-module: libs/{common-http,security-jwt,markdown,test-support},
  services/{identity,academic,progress,gateway}, web (Thymeleaf+htmx)
- identity-service: JWT auth (RSA), accounts, students, groups, enrollment,
  import from XLSX/CSV, credentials export, password reset
- academic-service: lab import from JSON/zip (markdown + YAML + variants),
  levels, API
- progress-service: schema for student levels and variant assignments
- gateway: Spring Cloud Gateway, JWT validation, route propagation
- web: Server-side UI with flex/footer layout, light/dark theme toggle,
  admin dashboard, groups CRUD, student portal placeholder
- docker-compose: PostgreSQL 18
- Tests: identity smoke test with Testcontainers

services/gateway/src/main/kotlin/ru/ysu/lms/gateway/GatewayApplication.kt

@@ -0,0 +1,11 @@
+package ru.ysu.lms.gateway
+
+import org.springframework.boot.autoconfigure.SpringBootApplication
+import org.springframework.boot.runApplication
+
+@SpringBootApplication
+class GatewayApplication
+
+fun main(args: Array<String>) {
+    runApplication<GatewayApplication>(*args)
+}

services/gateway/src/main/kotlin/ru/ysu/lms/gateway/security/JwtAuthenticationFilter.kt

@@ -0,0 +1,66 @@
+package ru.ysu.lms.gateway.security
+
+import org.springframework.cloud.gateway.filter.GatewayFilterChain
+import org.springframework.cloud.gateway.filter.GlobalFilter
+import org.springframework.core.Ordered
+import org.springframework.http.HttpStatus
+import org.springframework.http.MediaType
+import org.springframework.security.oauth2.jwt.JwtDecoder
+import org.springframework.security.oauth2.jwt.JwtException
+import org.springframework.stereotype.Component
+import org.springframework.web.server.ServerWebExchange
+import reactor.core.publisher.Mono
+
+/**
+ * Validates the bearer token on every routed request and forwards the resolved
+ * identity to the downstream services as `X-Account-*` headers.
+ */
+@Component
+class JwtAuthenticationFilter(private val jwtDecoder: JwtDecoder) : GlobalFilter, Ordered {
+
+    override fun filter(exchange: ServerWebExchange, chain: GatewayFilterChain): Mono<Void> {
+        val path = exchange.request.path.value()
+        if (isPublic(path)) {
+            return chain.filter(exchange)
+        }
+        val token = bearerToken(exchange)
+            ?: return unauthorized(exchange, "Требуется вход")
+        return try {
+            val jwt = jwtDecoder.decode(token)
+            val request = exchange.request.mutate()
+                .header("X-Account-Id", jwt.subject.orEmpty())
+                .header("X-Account-Login", jwt.getClaimAsString("login").orEmpty())
+                .header("X-Account-Role", jwt.getClaimAsString("role").orEmpty())
+                .build()
+            chain.filter(exchange.mutate().request(request).build())
+        } catch (_: JwtException) {
+            unauthorized(exchange, "Недействительный или истёкший токен")
+        }
+    }
+
+    override fun getOrder(): Int = -100
+
+    private fun isPublic(path: String): Boolean =
+        path.startsWith("/actuator") ||
+            path == "/api/v1/auth/login" ||
+            path == "/api/v1/auth/setup" ||
+            path == "/api/v1/auth/health" ||
+            path == "/api/v1/auth/jwks.json"
+
+    private fun bearerToken(exchange: ServerWebExchange): String? {
+        val header = exchange.request.headers.getFirst("Authorization") ?: return null
+        if (!header.startsWith("Bearer ")) {
+            return null
+        }
+        return header.removePrefix("Bearer ").trim().ifBlank { null }
+    }
+
+    private fun unauthorized(exchange: ServerWebExchange, message: String): Mono<Void> {
+        val response = exchange.response
+        response.statusCode = HttpStatus.UNAUTHORIZED
+        response.headers.contentType = MediaType.APPLICATION_JSON
+        val body = """{"status":401,"title":"Unauthorized","detail":"$message"}"""
+        val buffer = response.bufferFactory().wrap(body.toByteArray(Charsets.UTF_8))
+        return response.writeWith(Mono.just(buffer))
+    }
+}

services/gateway/src/main/resources/application.yml

@@ -0,0 +1,37 @@
+server:
+  port: ${SERVER_PORT:8080}
+
+spring:
+  application:
+    name: gateway
+  cloud:
+    gateway:
+      server:
+        webflux:
+          routes:
+            - id: identity
+              uri: ${LMS_IDENTITY_URI:http://localhost:8081}
+              predicates:
+                - Path=/api/v1/auth/**,/api/v1/accounts/**,/api/v1/groups/**,/api/v1/students/**
+            - id: academic
+              uri: ${LMS_ACADEMIC_URI:http://localhost:8082}
+              predicates:
+                - Path=/api/v1/courses/**,/api/v1/articles/**,/api/v1/labs/**,/api/v1/assets/**
+            - id: progress
+              uri: ${LMS_PROGRESS_URI:http://localhost:8083}
+              predicates:
+                - Path=/api/v1/assignments/**,/api/v1/levels/**,/api/v1/me/**,/api/v1/distribute/**
+
+management:
+  endpoints:
+    web:
+      exposure:
+        include: health,info,gateway
+  endpoint:
+    health:
+      probes:
+        enabled: true
+
+lms:
+  jwt:
+    jwk-set-uri: ${LMS_JWT_JWK_SET_URI:http://localhost:8081/api/v1/auth/jwks.json}