Phase 7: deployment, data import, UI hardening and security fixes

Docker/prod deployment:
- multi-stage Dockerfile (JDK21 build, JRE21 run), docker-compose.prod.yml,
  nginx config for lms.our-place.ru, deploy.sh; DEPLOY/IMPORT guides (UI flow)
- Fix Docker 401: LMS_JWT_JWK_SET_URI for academic/progress; forward-headers

Variant distribution (lab page only):
- round-robin by student level, shared random queue across selected groups,
  least-used variants, manual pins always preserved; occupied/dup labels
- setup page: single form + one «Сохранить всё», batch level/variant for
  selected students (checkboxes)

Grades, defense, materials:
- publication gate + comment lists; defense CSV import (2/3 cols, quotes)
- additional task after defense ("начать заново"); enroll/unenroll students
  from group page; temporary-password lock (no navigation until changed) and
  persistent "Смена пароля"; forced change once
- chapter page /learn/{c}; header: LMS home, Войти, user -> dashboard,
  compact theme toggle; responsive mobile header
- markdown: single newlines are soft breaks; highlight.js with light/dark themes
- lab/content imports ZIP-only (lab.yaml+README+variants/assets,
  chapters tree+assets); duplicate lab numbers rejected; variant ordering
  and date defaults honored

Fixes:
- 500 on student create (@MapsId set before persist); broken dialogs/JS refs in group page

web/src/main/resources/static/js/defense-timer.js

@@ -0,0 +1,23 @@
+document.querySelectorAll('.defense-timer').forEach(function (el) {
+    var left = parseInt(el.getAttribute('data-seconds') || '0', 10);
+    function render(v) {
+        var m = Math.floor(v / 60), s = v % 60;
+        el.textContent = 'Осталось времени: ' + m + ':' + (s < 10 ? '0' : '') + s;
+    }
+    render(left);
+    var tick = setInterval(function () {
+        left -= 1;
+        if (left <= 0) { clearInterval(tick); window.location.reload(); return; }
+        render(left);
+    }, 1000);
+});
+document.querySelectorAll('.ru-datetime').forEach(function (el) {
+    try {
+        var iso = (el.textContent || '').trim();
+        if (iso && !el.getAttribute('data-done')) {
+            var d = new Date(iso);
+            el.textContent = new Intl.DateTimeFormat('ru-RU', { dateStyle: 'short', timeStyle: 'short', timeZone: 'Europe/Moscow' }).format(d);
+            el.setAttribute('data-done', '1');
+        }
+    } catch (e) {}
+});