- DateUtils: format ISO instants as dd.MM.yyyy HH:mm in Europe/Moscow
- admin/lab page and student dashboard show deadlines in MSK time
- CSRF failure redirects to /login with friendly message instead of 403
- session tracking-modes=cookie (no ;jsessionid in URLs) (previously set)
- web rebuild with all dialog/status-toggle fixes verified end-to-end
- Dashboard: real stats (groups, students, labs, average grade), labs/groups
summary lists, no placeholder tile
- Lab page: view + edit combined — metadata form in modal, condition rendered
as markdown, per-level variant tables with add/edit/delete dialogs,
level rename/delete, student level/variant selectors with group filter
- Labs list: create-lab dialog with manual level entry (code; title lines)
- Groups: create-group dialog, add-student dialog (auto password, toast card)
- Content: public /learn reader is the single place; admin buttons (new
article with chapter/section create-or-select, rename/delete chapters and
sections, move articles between sections, import zip) appear for admins;
removed separate 'Контент' admin section
- Buttons use btn classes instead of nav-link
- Favicon: generated SVG book icon
- Security: CSRF synchronizer token interceptor (replaced spring-security in
web which broke logback under nested jars), session regenerated on login,
hardened session cookie, gateway actuator limited to health,info
- Jackson 3: nullable-safe request DTOs for labs (FAIL_ON_NULL_FOR_PRIMITIVES)
- academic: POST /labs (manual create with levels), level add/rename/delete,
content chapters/sections CRUD, article create/move/delete endpoints
