- markdown: new directives `:::figure assets/x.png | Подпись` and
`:::video assets/x.mp4 | Подпись` rendered as figure/figcaption and a
video player (works with HTML escaping on); sanitizer allows video/source/
track/figure with safe attributes only
- assets: video extensions (mp4/webm/ogg) allowed, separate limits — images
up to 10 MB, video up to 100 MB; correct content types
- upload limits raised: web/academic multipart 120 MB per file / 200 MB per
request, nginx client_max_body_size 200m (covers media inside ZIP imports)
- docs: new docs/06-authoring.md (markdown, images, video, assets, limits,
import semantics); import message now says "медиафайлов"
- DateUtils: format ISO instants as dd.MM.yyyy HH:mm in Europe/Moscow
- admin/lab page and student dashboard show deadlines in MSK time
- CSRF failure redirects to /login with friendly message instead of 403
- session tracking-modes=cookie (no ;jsessionid in URLs) (previously set)
- web rebuild with all dialog/status-toggle fixes verified end-to-end
- Dashboard: real stats (groups, students, labs, average grade), labs/groups
summary lists, no placeholder tile
- Lab page: view + edit combined — metadata form in modal, condition rendered
as markdown, per-level variant tables with add/edit/delete dialogs,
level rename/delete, student level/variant selectors with group filter
- Labs list: create-lab dialog with manual level entry (code; title lines)
- Groups: create-group dialog, add-student dialog (auto password, toast card)
- Content: public /learn reader is the single place; admin buttons (new
article with chapter/section create-or-select, rename/delete chapters and
sections, move articles between sections, import zip) appear for admins;
removed separate 'Контент' admin section
- Buttons use btn classes instead of nav-link
- Favicon: generated SVG book icon
- Security: CSRF synchronizer token interceptor (replaced spring-security in
web which broke logback under nested jars), session regenerated on login,
hardened session cookie, gateway actuator limited to health,info
- Jackson 3: nullable-safe request DTOs for labs (FAIL_ON_NULL_FOR_PRIMITIVES)
- academic: POST /labs (manual create with levels), level add/rename/delete,
content chapters/sections CRUD, article create/move/delete endpoints
