Phase 7: deployment, data import, UI hardening and security fixes

Docker/prod deployment:
- multi-stage Dockerfile (JDK21 build, JRE21 run), docker-compose.prod.yml,
  nginx config for lms.our-place.ru, deploy.sh; DEPLOY/IMPORT guides (UI flow)
- Fix Docker 401: LMS_JWT_JWK_SET_URI for academic/progress; forward-headers

Variant distribution (lab page only):
- round-robin by student level, shared random queue across selected groups,
  least-used variants, manual pins always preserved; occupied/dup labels
- setup page: single form + one «Сохранить всё», batch level/variant for
  selected students (checkboxes)

Grades, defense, materials:
- publication gate + comment lists; defense CSV import (2/3 cols, quotes)
- additional task after defense ("начать заново"); enroll/unenroll students
  from group page; temporary-password lock (no navigation until changed) and
  persistent "Смена пароля"; forced change once
- chapter page /learn/{c}; header: LMS home, Войти, user -> dashboard,
  compact theme toggle; responsive mobile header
- markdown: single newlines are soft breaks; highlight.js with light/dark themes
- lab/content imports ZIP-only (lab.yaml+README+variants/assets,
  chapters tree+assets); duplicate lab numbers rejected; variant ordering
  and date defaults honored

Fixes:
- 500 on student create (@MapsId set before persist); broken dialogs/JS refs in group page

Dockerfile

@@ -0,0 +1,64 @@
+# syntax=docker/dockerfile:1
+#
+# Единый multi-stage Dockerfile для всего LMS.
+# Сборка идёт внутри образа (Gradle + JDK 21), поэтому на сервере
+# достаточно Docker — устанавливать Java не требуется.
+#
+# Использование (см. docker-compose.prod.yml):
+#   docker build --target web        -t lms-web .
+#   docker build --target identity   -t lms-identity .
+
+# ---------- Стадия сборки ----------
+FROM eclipse-temurin:21-jdk AS build
+WORKDIR /src
+
+# Сначала копируем файлы сборки — слой кэшируется отдельно от исходников.
+COPY gradlew gradlew
+COPY gradle gradle
+COPY settings.gradle.kts gradle.properties ./
+COPY buildSrc buildSrc
+RUN chmod +x gradlew
+
+# Исходники модулей.
+COPY libs libs
+COPY services services
+COPY web web
+
+RUN --mount=type=cache,target=/root/.gradle \
+    ./gradlew --no-daemon bootJar -x test
+
+# ---------- Runtime-стадии (только JRE) ----------
+FROM eclipse-temurin:21-jre AS identity
+WORKDIR /app
+ENV TZ=Europe/Moscow JAVA_OPTS="-Xmx320m"
+COPY --from=build /src/services/identity-service/build/libs/identity-service-*.jar app.jar
+EXPOSE 8081
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]
+
+FROM eclipse-temurin:21-jre AS academic
+WORKDIR /app
+ENV TZ=Europe/Moscow JAVA_OPTS="-Xmx384m"
+COPY --from=build /src/services/academic-service/build/libs/academic-service-*.jar app.jar
+EXPOSE 8082
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]
+
+FROM eclipse-temurin:21-jre AS progress
+WORKDIR /app
+ENV TZ=Europe/Moscow JAVA_OPTS="-Xmx384m"
+COPY --from=build /src/services/progress-service/build/libs/progress-service-*.jar app.jar
+EXPOSE 8083
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]
+
+FROM eclipse-temurin:21-jre AS gateway
+WORKDIR /app
+ENV TZ=Europe/Moscow JAVA_OPTS="-Xmx256m"
+COPY --from=build /src/services/gateway/build/libs/gateway-*.jar app.jar
+EXPOSE 8080
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]
+
+FROM eclipse-temurin:21-jre AS web
+WORKDIR /app
+ENV TZ=Europe/Moscow JAVA_OPTS="-Xmx320m"
+COPY --from=build /src/web/build/libs/web-*.jar app.jar
+EXPOSE 8090
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]