feat: harden auth and study workflows

- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads

- add login challenge replay protection, production RSA key validation, and auth tests

- wire compose to environment-driven dev/prod settings without committing local secrets

- update setup-config smoke scripts and Postman docs for encrypted login

- add visit schedule migrations/tests and update study/subject setup workflows

backend/app/api/v1/visits.py

@@ -90,15 +90,12 @@ async def create_visit(
     if next_visit_code == "V1" and visit_in.planned_date:
         study = await study_crud.get(db, study_id)
         if study:
-            await visit_crud.create_followup_visits(
+            await visit_crud.create_scheduled_visits(
                 db,
                 study_id=study_id,
                 subject=subject,
                 base_date=visit_in.planned_date,
-                visit_total=study.visit_total,
-                visit_interval_days=study.visit_interval_days,
-                window_start_offset=study.visit_window_start_offset,
-                window_end_offset=study.visit_window_end_offset,
+                visit_schedule=study.visit_schedule,
             )
     await audit_crud.log_action(
         db,