Phase 7: deployment, data import, UI hardening and security fixes

Docker/prod deployment:
- multi-stage Dockerfile (JDK21 build, JRE21 run), docker-compose.prod.yml,
  nginx config for lms.our-place.ru, deploy.sh; DEPLOY/IMPORT guides (UI flow)
- Fix Docker 401: LMS_JWT_JWK_SET_URI for academic/progress; forward-headers

Variant distribution (lab page only):
- round-robin by student level, shared random queue across selected groups,
  least-used variants, manual pins always preserved; occupied/dup labels
- setup page: single form + one «Сохранить всё», batch level/variant for
  selected students (checkboxes)

Grades, defense, materials:
- publication gate + comment lists; defense CSV import (2/3 cols, quotes)
- additional task after defense ("начать заново"); enroll/unenroll students
  from group page; temporary-password lock (no navigation until changed) and
  persistent "Смена пароля"; forced change once
- chapter page /learn/{c}; header: LMS home, Войти, user -> dashboard,
  compact theme toggle; responsive mobile header
- markdown: single newlines are soft breaks; highlight.js with light/dark themes
- lab/content imports ZIP-only (lab.yaml+README+variants/assets,
  chapters tree+assets); duplicate lab numbers rejected; variant ordering
  and date defaults honored

Fixes:
- 500 on student create (@MapsId set before persist); broken dialogs/JS refs in group page

deploy/deploy.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Деплой LMS в Docker на сервере. Java на хосте не требуется.
+#
+#   ./deploy/deploy.sh            # сборка + запуск/обновление
+#   ./deploy/deploy.sh logs web   # логи сервиса
+#   ./deploy/deploy.sh ps
+#   ./deploy/deploy.sh down       # остановить (данные сохраняются в volume)
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+COMPOSE="docker compose -f docker-compose.prod.yml --env-file .env.prod"
+
+if ! command -v docker >/dev/null 2>&1 || ! docker compose version >/dev/null 2>&1; then
+    echo "Ошибка: нужен Docker с плагином compose v2." >&2
+    exit 1
+fi
+
+if [[ ! -f .env.prod ]]; then
+    if [[ -f .env.prod.example ]]; then
+        cp .env.prod.example .env.prod
+        echo "Создан .env.prod из примера. ОБЯЗАТЕЛЬНО смените LMS_DB_PASSWORD и повторите запуск." >&2
+        exit 1
+    fi
+    echo "Не найден .env.prod" >&2
+    exit 1
+fi
+
+cmd="${1:-up}"
+
+case "$cmd" in
+    up)
+        echo ">> Сборка образов (Gradle внутри Docker, сервер Java не требует)..."
+        $COMPOSE build
+        echo ">> Запуск сервисов..."
+        $COMPOSE up -d --remove-orphans
+        echo
+        $COMPOSE ps
+        echo
+        echo "Готово. Проверьте: curl -fsS http://127.0.0.1:${LMS_WEB_PORT:-8090}/actuator/health"
+        echo "Первый запуск: откройте https://<домен>/setup и создайте администратора."
+        ;;
+    logs)
+        $COMPOSE logs -f --tail=200 "${2:-web}"
+        ;;
+    ps)
+        $COMPOSE ps
+        ;;
+    down)
+        $COMPOSE down
+        ;;
+    restart)
+        $COMPOSE restart "${2:-}"
+        ;;
+    *)
+        echo "usage: $0 [up|ps|logs <service>|restart [service]|down]" >&2
+        exit 1
+        ;;
+esac