- markdown: new directives `:::figure assets/x.png | Подпись` and
`:::video assets/x.mp4 | Подпись` rendered as figure/figcaption and a
video player (works with HTML escaping on); sanitizer allows video/source/
track/figure with safe attributes only
- assets: video extensions (mp4/webm/ogg) allowed, separate limits — images
up to 10 MB, video up to 100 MB; correct content types
- upload limits raised: web/academic multipart 120 MB per file / 200 MB per
request, nginx client_max_body_size 200m (covers media inside ZIP imports)
- docs: new docs/06-authoring.md (markdown, images, video, assets, limits,
import semantics); import message now says "медиафайлов"
- migration V5 adds published flag (default true) to chapters/sections/articles
- ContentService: tree(includeHidden) filters, treeAll(), findArticle(includeHidden),
set*Published; public tree/article expose only published items
- admin API: GET /tree/all, GET /all/{chapter}/{section}/{article}, PUT
/{chapters|sections|articles}/{id}/published
- web: learn pages for admins load the full tree, show "скрыто" badges and
publish/hide buttons for every chapter, section and article; hidden articles
open in preview for admins, guests get "not found"; article view carries
published flag
- Dashboard: real stats (groups, students, labs, average grade), labs/groups
summary lists, no placeholder tile
- Lab page: view + edit combined — metadata form in modal, condition rendered
as markdown, per-level variant tables with add/edit/delete dialogs,
level rename/delete, student level/variant selectors with group filter
- Labs list: create-lab dialog with manual level entry (code; title lines)
- Groups: create-group dialog, add-student dialog (auto password, toast card)
- Content: public /learn reader is the single place; admin buttons (new
article with chapter/section create-or-select, rename/delete chapters and
sections, move articles between sections, import zip) appear for admins;
removed separate 'Контент' admin section
- Buttons use btn classes instead of nav-link
- Favicon: generated SVG book icon
- Security: CSRF synchronizer token interceptor (replaced spring-security in
web which broke logback under nested jars), session regenerated on login,
hardened session cookie, gateway actuator limited to health,info
- Jackson 3: nullable-safe request DTOs for labs (FAIL_ON_NULL_FOR_PRIMITIVES)
- academic: POST /labs (manual create with levels), level add/rename/delete,
content chapters/sections CRUD, article create/move/delete endpoints
