Phase 7: deployment, data import, UI hardening and security fixes

Docker/prod deployment:
- multi-stage Dockerfile (JDK21 build, JRE21 run), docker-compose.prod.yml,
  nginx config for lms.our-place.ru, deploy.sh; DEPLOY/IMPORT guides (UI flow)
- Fix Docker 401: LMS_JWT_JWK_SET_URI for academic/progress; forward-headers

Variant distribution (lab page only):
- round-robin by student level, shared random queue across selected groups,
  least-used variants, manual pins always preserved; occupied/dup labels
- setup page: single form + one «Сохранить всё», batch level/variant for
  selected students (checkboxes)

Grades, defense, materials:
- publication gate + comment lists; defense CSV import (2/3 cols, quotes)
- additional task after defense ("начать заново"); enroll/unenroll students
  from group page; temporary-password lock (no navigation until changed) and
  persistent "Смена пароля"; forced change once
- chapter page /learn/{c}; header: LMS home, Войти, user -> dashboard,
  compact theme toggle; responsive mobile header
- markdown: single newlines are soft breaks; highlight.js with light/dark themes
- lab/content imports ZIP-only (lab.yaml+README+variants/assets,
  chapters tree+assets); duplicate lab numbers rejected; variant ordering
  and date defaults honored

Fixes:
- 500 on student create (@MapsId set before persist); broken dialogs/JS refs in group page

web/src/main/resources/templates/fragments/base.html

@@ -6,10 +6,28 @@
     <title th:replace="${title}">LMS</title>
     <link rel="icon" type="image/svg+xml" th:href="@{/favicon.svg}">
     <link rel="stylesheet" th:href="@{/css/app.css}">
+    <link id="hljs-light" rel="stylesheet" th:href="@{/css/hljs-github.css}">
+    <link id="hljs-dark" rel="stylesheet" th:href="@{/css/hljs-github-dark.css}" disabled>
     <script th:src="@{/js/htmx.min.js}" defer></script>
+    <script th:src="@{/js/highlight.min.js}" defer></script>
     <script>
-        (function(){ var t = localStorage.getItem('lms-theme') || 'light'; document.documentElement.setAttribute('data-theme', t); })();
-        function toggleTheme(){ var e=document.documentElement; var t=e.getAttribute('data-theme')==='dark'?'light':'dark'; e.setAttribute('data-theme',t); localStorage.setItem('lms-theme',t); }
+        (function(){
+            var t = localStorage.getItem('lms-theme') || 'light';
+            document.documentElement.setAttribute('data-theme', t);
+            window.__hljsSet = function(theme){
+                var l = document.getElementById('hljs-light'), d = document.getElementById('hljs-dark');
+                if (l && d) { l.disabled = theme !== 'light'; d.disabled = theme !== 'dark'; }
+            };
+            window.__hljsAll = function(){
+                if (!window.hljs) return;
+                document.querySelectorAll('pre code').forEach(function(el){ window.hljs.highlightElement(el); });
+            };
+        })();
+        document.addEventListener('DOMContentLoaded', function(){ window.__hljsSet(document.documentElement.getAttribute('data-theme')); window.__hljsAll(); });
+        function toggleTheme(){
+            var e=document.documentElement; var t=e.getAttribute('data-theme')==='dark'?'light':'dark';
+            e.setAttribute('data-theme',t); localStorage.setItem('lms-theme',t); window.__hljsSet(t);
+        }
         function openModal(id){ var d=document.getElementById(id); if(d) d.showModal(); }
         function closeModal(id){ var d=document.getElementById(id); if(d) d.close(); }
         function openModalData(btn){ openModal(btn.dataset.modal); }
@@ -22,14 +40,32 @@
         <div class="page-header-inner">
             <a th:href="@{/}" class="logo">LMS</a>
             <nav class="nav">
-                <a th:href="@{/learn}" class="nav-link">Материалы</a>
                 <th:block th:if="${currentUser != null}">
                     <a th:if="${currentUser.admin}" th:href="@{/admin/groups}" class="nav-link">Группы</a>
                     <a th:if="${currentUser.admin}" th:href="@{/admin/labs}" class="nav-link">Лабораторные</a>
                     <a th:unless="${currentUser.admin}" th:href="@{/student/labs}" class="nav-link">Лабораторные</a>
-                    <span class="nav-sep" th:text="${currentUser.name}">—</span>
+                    <a th:href="@{/change-password}" class="nav-link">Смена пароля</a>
+                    <a th:if="${currentUser.admin}" th:href="@{/admin}" class="nav-link nav-user" th:text="${currentUser.name}" title="Личный кабинет">—</a>
+                    <a th:unless="${currentUser.admin}" th:href="@{/student}" class="nav-link nav-user" th:text="${currentUser.name}" title="Личный кабинет">—</a>
                 </th:block>
-                <button onclick="toggleTheme()" class="btn btn-secondary btn-sm">☀/🌙</button>
+                <a th:if="${currentUser == null}" th:href="@{/login}" class="btn btn-secondary btn-sm">Войти</a>
+                <button type="button" onclick="toggleTheme()" class="btn btn-secondary btn-sm theme-btn"
+                        aria-label="Сменить тему" title="Сменить тему">
+                    <svg class="theme-icon" viewBox="0 0 24 24" aria-hidden="true" focusable="false">
+                        <circle cx="12" cy="12" r="5" fill="none" stroke="currentColor" stroke-width="1.6"/>
+                        <path d="M12 7 a5 5 0 0 1 0 10 z" fill="currentColor"/>
+                        <g stroke="currentColor" stroke-width="1.6" stroke-linecap="round">
+                            <line x1="12" y1="1.4" x2="12" y2="3.2"/>
+                            <line x1="12" y1="20.8" x2="12" y2="22.6"/>
+                            <line x1="1.4" y1="12" x2="3.2" y2="12"/>
+                            <line x1="20.8" y1="12" x2="22.6" y2="12"/>
+                            <line x1="4.5" y1="4.5" x2="5.8" y2="5.8"/>
+                            <line x1="18.2" y1="18.2" x2="19.5" y2="19.5"/>
+                            <line x1="4.5" y1="19.5" x2="5.8" y2="18.2"/>
+                            <line x1="18.2" y1="5.8" x2="19.5" y2="4.5"/>
+                        </g>
+                    </svg>
+                </button>
                 <form th:if="${currentUser != null}" th:action="@{/logout}" method="post">
                     <button class="btn btn-secondary" type="submit">Выйти</button>
                 <input type="hidden" name="_csrf" th:value="${csrfToken}">