Initial commit: LMS microservices scaffold

- Gradle multi-module: libs/{common-http,security-jwt,markdown,test-support},
  services/{identity,academic,progress,gateway}, web (Thymeleaf+htmx)
- identity-service: JWT auth (RSA), accounts, students, groups, enrollment,
  import from XLSX/CSV, credentials export, password reset
- academic-service: lab import from JSON/zip (markdown + YAML + variants),
  levels, API
- progress-service: schema for student levels and variant assignments
- gateway: Spring Cloud Gateway, JWT validation, route propagation
- web: Server-side UI with flex/footer layout, light/dark theme toggle,
  admin dashboard, groups CRUD, student portal placeholder
- docker-compose: PostgreSQL 18
- Tests: identity smoke test with Testcontainers

services/progress-service/src/main/kotlin/ru/ysu/lms/progress/ProgressServiceApplication.kt

@@ -0,0 +1,12 @@
+package ru.ysu.lms.progress
+
+import org.springframework.boot.autoconfigure.SpringBootApplication
+import org.springframework.boot.runApplication
+import ru.ysu.lms.security.LmsSecurityAutoConfiguration
+
+@SpringBootApplication
+class ProgressServiceApplication
+
+fun main(args: Array<String>) {
+    runApplication<ProgressServiceApplication>(*args)
+}

services/progress-service/src/main/kotlin/ru/ysu/lms/progress/domain/VariantAssignment.kt

@@ -0,0 +1,33 @@
+package ru.ysu.lms.progress.domain
+
+import jakarta.persistence.Column
+import jakarta.persistence.Entity
+import jakarta.persistence.Id
+import jakarta.persistence.Table
+import ru.ysu.lms.common.Ids
+import java.time.Instant
+import java.util.UUID
+
+@Entity
+@Table(name = "variant_assignments")
+class VariantAssignment(
+    @Id var id: UUID = Ids.v7(),
+    @Column(nullable = false) var studentId: UUID = UUID(0,0),
+    @Column(nullable = false) var labId: UUID = UUID(0,0),
+    @Column(nullable = false) var variantId: UUID = UUID(0,0),
+    @Column(nullable = false) var manual: Boolean = false,
+    @Column(nullable = false) var assignedAt: Instant = Instant.now(),
+)
+
+@Entity
+@Table(name = "student_lab_levels")
+class StudentLabLevel(
+    @Id
+    @Column(name = "student_id", insertable = false, updatable = false)
+    var studentId: UUID = UUID(0,0),
+    @Id
+    @Column(name = "lab_id", insertable = false, updatable = false)
+    var labId: UUID = UUID(0,0),
+    @Column(nullable = false) var labLevelId: UUID = UUID(0,0),
+    @Column(nullable = false) var manual: Boolean = false,
+)

services/progress-service/src/main/kotlin/ru/ysu/lms/progress/security/SecurityConfig.kt

@@ -0,0 +1,38 @@
+package ru.ysu.lms.progress.security
+
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
+import org.springframework.security.config.http.SessionCreationPolicy
+import org.springframework.security.oauth2.jwt.JwtDecoder
+import org.springframework.security.oauth2.jwt.NimbusJwtDecoder
+import org.springframework.security.web.SecurityFilterChain
+
+@Configuration
+@EnableWebSecurity
+@EnableMethodSecurity
+class SecurityConfig {
+
+    @Bean
+    fun jwtDecoder(): JwtDecoder = NimbusJwtDecoder.withJwkSetUri(JWK_URI).build()
+
+    @Bean
+    fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
+        http
+            .csrf { it.disable() }
+            .cors { it.disable() }
+            .sessionManagement { it.sessionCreationPolicy(SessionCreationPolicy.STATELESS) }
+            .authorizeHttpRequests { auth ->
+                auth.requestMatchers("/actuator/**", "/v3/api-docs/**", "/swagger-ui/**").permitAll()
+                auth.anyRequest().authenticated()
+            }
+            .oauth2ResourceServer { it.jwt { } }
+        return http.build()
+    }
+
+    companion object {
+        private val JWK_URI = System.getenv("LMS_JWT_JWK_SET_URI") ?: "http://localhost:8081/api/v1/auth/jwks.json"
+    }
+}

services/progress-service/src/main/resources/application.yml

@@ -0,0 +1,30 @@
+server:
+  port: ${SERVER_PORT:8083}
+spring:
+  application:
+    name: progress-service
+  datasource:
+    url: ${LMS_DB_URL:jdbc:postgresql://localhost:5432/lms?currentSchema=progress}
+    username: ${LMS_DB_USER:lms}
+    password: ${LMS_DB_PASSWORD:lms}
+  jpa:
+    open-in-view: false
+    hibernate:
+      ddl-auto: validate
+    properties:
+      hibernate:
+        default_schema: progress
+  flyway:
+    enabled: true
+    locations: classpath:db/migration
+    schemas: progress
+    default-schema: progress
+    create-schemas: true
+management:
+  endpoints:
+    web:
+      exposure:
+        include: health,info
+springdoc:
+  api-docs:
+    path: /v3/api-docs

services/progress-service/src/main/resources/db/migration/V1__init.sql

@@ -0,0 +1,2 @@
+-- Baseline: student lab levels and variant assignments.
+CREATE SCHEMA IF NOT EXISTS progress;

services/progress-service/src/main/resources/db/migration/V2__schema.sql

@@ -0,0 +1,22 @@
+-- Student levels per lab and variant assignments.
+
+CREATE TABLE student_lab_levels (
+    student_id   uuid        NOT NULL,
+    lab_id       uuid        NOT NULL,
+    lab_level_id uuid        NOT NULL,
+    manual       boolean     NOT NULL DEFAULT false,
+    updated_at   timestamptz NOT NULL DEFAULT now(),
+    PRIMARY KEY (student_id, lab_id)
+);
+
+CREATE TABLE variant_assignments (
+    id          uuid PRIMARY KEY DEFAULT uuidv7(),
+    student_id  uuid        NOT NULL,
+    lab_id      uuid        NOT NULL,
+    variant_id  uuid        NOT NULL,
+    manual      boolean     NOT NULL DEFAULT false,
+    assigned_at timestamptz NOT NULL DEFAULT now(),
+    CONSTRAINT va_student_lab_unique UNIQUE (student_id, lab_id)
+);
+
+CREATE INDEX va_lab_idx ON variant_assignments (lab_id);