Phase 7: deployment, data import, UI hardening and security fixes

Docker/prod deployment:
- multi-stage Dockerfile (JDK21 build, JRE21 run), docker-compose.prod.yml,
  nginx config for lms.our-place.ru, deploy.sh; DEPLOY/IMPORT guides (UI flow)
- Fix Docker 401: LMS_JWT_JWK_SET_URI for academic/progress; forward-headers

Variant distribution (lab page only):
- round-robin by student level, shared random queue across selected groups,
  least-used variants, manual pins always preserved; occupied/dup labels
- setup page: single form + one «Сохранить всё», batch level/variant for
  selected students (checkboxes)

Grades, defense, materials:
- publication gate + comment lists; defense CSV import (2/3 cols, quotes)
- additional task after defense ("начать заново"); enroll/unenroll students
  from group page; temporary-password lock (no navigation until changed) and
  persistent "Смена пароля"; forced change once
- chapter page /learn/{c}; header: LMS home, Войти, user -> dashboard,
  compact theme toggle; responsive mobile header
- markdown: single newlines are soft breaks; highlight.js with light/dark themes
- lab/content imports ZIP-only (lab.yaml+README+variants/assets,
  chapters tree+assets); duplicate lab numbers rejected; variant ordering
  and date defaults honored

Fixes:
- 500 on student create (@MapsId set before persist); broken dialogs/JS refs in group page

deploy/nginx/lms.our-place.ru.conf

@@ -0,0 +1,67 @@
+# Nginx для LMS на сервере lms.our-place.ru.
+#
+# Схема:
+#   интернет -> nginx (80/443) -> 127.0.0.1:8090 (контейнер web)
+#
+# Установка (Debian/Ubuntu):
+#   sudo cp deploy/nginx/lms.our-place.ru.conf /etc/nginx/sites-available/lms.our-place.ru.conf
+#   sudo ln -sf /etc/nginx/sites-available/lms.our-place.ru.conf /etc/nginx/sites-enabled/lms.our-place.ru.conf
+#   sudo nginx -t && sudo systemctl reload nginx
+#   sudo certbot --nginx -d lms.our-place.ru        # добавит TLS автоматически
+#
+# Ниже — HTTP-версия, достаточная и для первичного выпуска сертификата,
+# и для работы без TLS. После `certbot --nginx` блок server 443 появится сам.
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name lms.our-place.ru;
+
+    # ACME-челлендж Let's Encrypt.
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    # Большие загрузки: ZIP лаб, решения, материалы.
+    client_max_body_size 120m;
+
+    location / {
+        proxy_pass http://127.0.0.1:8090;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host  $host;
+
+        # Загрузка файлов может быть долгой.
+        proxy_read_timeout    300s;
+        proxy_send_timeout    300s;
+        proxy_connect_timeout 30s;
+    }
+}
+
+# --- Если TLS настраивается вручную (без certbot --nginx) ---
+# server {
+#     listen 443 ssl;
+#     listen [::]:443 ssl;
+#     http2 on;
+#     server_name lms.our-place.ru;
+#
+#     ssl_certificate     /etc/letsencrypt/live/lms.our-place.ru/fullchain.pem;
+#     ssl_certificate_key /etc/letsencrypt/live/lms.our-place.ru/privkey.pem;
+#     ssl_protocols TLSv1.2 TLSv1.3;
+#
+#     client_max_body_size 120m;
+#
+#     location / {
+#         proxy_pass http://127.0.0.1:8090;
+#         proxy_http_version 1.1;
+#         proxy_set_header Host              $host;
+#         proxy_set_header X-Real-IP         $remote_addr;
+#         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+#         proxy_set_header X-Forwarded-Proto $scheme;
+#         proxy_read_timeout 300s;
+#         proxy_send_timeout 300s;
+#     }
+# }