feat: harden auth and study workflows

- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads

- add login challenge replay protection, production RSA key validation, and auth tests

- wire compose to environment-driven dev/prod settings without committing local secrets

- update setup-config smoke scripts and Postman docs for encrypted login

- add visit schedule migrations/tests and update study/subject setup workflows

backend/app/api/v1/studies.py

@@ -283,13 +283,8 @@ def _build_project_publish_snapshot(study) -> ProjectPublishSnapshot:
         plan_end_date=_to_date_text(getattr(study, "plan_end_date", None)),
         planned_site_count=getattr(study, "planned_site_count", None),
         planned_enrollment_count=getattr(study, "planned_enrollment_count", None),
-        summary_note=getattr(study, "summary_note", None) or "",
-        objective_note=getattr(study, "objective_note", None) or "",
         status=getattr(study, "status", None) or "",
-        visit_interval_days=getattr(study, "visit_interval_days", None),
-        visit_total=getattr(study, "visit_total", None),
-        visit_window_start_offset=getattr(study, "visit_window_start_offset", None),
-        visit_window_end_offset=getattr(study, "visit_window_end_offset", None),
+        visit_schedule=getattr(study, "visit_schedule", None) or [],
     )
 
 
@@ -360,17 +355,9 @@ def _ensure_study_timeline_valid(
     *,
     plan_start_date: date | None,
     plan_end_date: date | None,
-    visit_window_start_offset: int | None,
-    visit_window_end_offset: int | None,
 ) -> None:
     if plan_start_date and plan_end_date and plan_start_date > plan_end_date:
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="项目计划结束日期不能早于开始日期")
-    if (
-        visit_window_start_offset is not None
-        and visit_window_end_offset is not None
-        and visit_window_start_offset > visit_window_end_offset
-    ):
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="访视窗口开始偏移不能晚于结束偏移")
 
 
 def _resolve_version_label(record: Any) -> str:
@@ -649,8 +636,6 @@ async def create_study(
     _ensure_study_timeline_valid(
         plan_start_date=study_in.plan_start_date,
         plan_end_date=study_in.plan_end_date,
-        visit_window_start_offset=study_in.visit_window_start_offset,
-        visit_window_end_offset=study_in.visit_window_end_offset,
     )
     study_in.code = study_in.code.strip()
     if not study_in.code:
@@ -746,21 +731,9 @@ async def update_study(
 
     next_plan_start = study_in.plan_start_date if "plan_start_date" in study_in.model_fields_set else study.plan_start_date
     next_plan_end = study_in.plan_end_date if "plan_end_date" in study_in.model_fields_set else study.plan_end_date
-    next_window_start = (
-        study_in.visit_window_start_offset
-        if "visit_window_start_offset" in study_in.model_fields_set
-        else study.visit_window_start_offset
-    )
-    next_window_end = (
-        study_in.visit_window_end_offset
-        if "visit_window_end_offset" in study_in.model_fields_set
-        else study.visit_window_end_offset
-    )
     _ensure_study_timeline_valid(
         plan_start_date=next_plan_start,
         plan_end_date=next_plan_end,
-        visit_window_start_offset=next_window_start,
-        visit_window_end_offset=next_window_end,
     )
     
     updated = await study_crud.update(db, study, study_in)