Phase 7: deployment, data import, UI hardening and security fixes

Docker/prod deployment:
- multi-stage Dockerfile (JDK21 build, JRE21 run), docker-compose.prod.yml,
  nginx config for lms.our-place.ru, deploy.sh; DEPLOY/IMPORT guides (UI flow)
- Fix Docker 401: LMS_JWT_JWK_SET_URI for academic/progress; forward-headers

Variant distribution (lab page only):
- round-robin by student level, shared random queue across selected groups,
  least-used variants, manual pins always preserved; occupied/dup labels
- setup page: single form + one «Сохранить всё», batch level/variant for
  selected students (checkboxes)

Grades, defense, materials:
- publication gate + comment lists; defense CSV import (2/3 cols, quotes)
- additional task after defense ("начать заново"); enroll/unenroll students
  from group page; temporary-password lock (no navigation until changed) and
  persistent "Смена пароля"; forced change once
- chapter page /learn/{c}; header: LMS home, Войти, user -> dashboard,
  compact theme toggle; responsive mobile header
- markdown: single newlines are soft breaks; highlight.js with light/dark themes
- lab/content imports ZIP-only (lab.yaml+README+variants/assets,
  chapters tree+assets); duplicate lab numbers rejected; variant ordering
  and date defaults honored

Fixes:
- 500 on student create (@MapsId set before persist); broken dialogs/JS refs in group page

web/src/main/resources/templates/admin/labs.html

@@ -5,7 +5,10 @@
 <div id="content">
     <div class="flex items-center justify-between gap-4 mb-6">
         <h1 class="page-title">Лабораторные</h1>
-        <button class="btn btn-primary" type="button" onclick="openModal('modal-create-lab')">+ Создать</button>
+        <div class="flex gap-2">
+            <button class="btn btn-secondary" type="button" onclick="openModal('modal-import-lab')">Импорт</button>
+            <button class="btn btn-primary" type="button" onclick="openModal('modal-create-lab')">+ Создать</button>
+        </div>
     </div>
     <p class="text-sm text-muted mb-4">Статус <b>draft</b> — черновик (редактирование, студентам не видна).
         <b>published</b> — опубликована (доступна студентам, видны распределённые варианты). Нажмите на бейдж статуса, чтобы переключить.</p>
@@ -36,6 +39,29 @@
     </div>
 
 
+    <dialog id="modal-import-lab" class="modal">
+        <div class="modal-header">
+            <h2 class="modal-title">Импорт лабораторной</h2>
+            <button class="modal-close" type="button" onclick="closeModal('modal-import-lab')">✕</button>
+        </div>
+        <div class="modal-body">
+            <form class="form-stack" th:action="@{/admin/labs/import}" method="post" enctype="multipart/form-data">
+                <div><label class="label" for="labFile">Файл</label>
+                    <input class="input" id="labFile" type="file" name="file" accept=".zip" required></div>
+                <p class="hint">
+                    Формат — ZIP: <code class="code">lab.yaml</code> + <code class="code">README.md</code> +
+                    <code class="code">variants/*.md</code> (front-matter: <code class="code">level</code>,
+                    <code class="code">number</code>, <code class="code">title</code>) +
+                    <code class="code">assets/</code> (картинки). Пример структуры — в
+                    <code class="code">deploy/IMPORT.md</code>.
+                </p>
+                <p class="hint">Даты сдачи и защиты после импорта задаются на карточке лабораторной.</p>
+                <button class="btn btn-primary" type="submit">Импортировать</button>
+                <input type="hidden" name="_csrf" th:value="${csrfToken}">
+            </form>
+        </div>
+    </dialog>
+
     <dialog id="modal-create-lab" class="modal">
         <div class="modal-header">
             <h2 class="modal-title">Новая лабораторная</h2>