feat: harden auth and study workflows

- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads

- add login challenge replay protection, production RSA key validation, and auth tests

- wire compose to environment-driven dev/prod settings without committing local secrets

- update setup-config smoke scripts and Postman docs for encrypted login

- add visit schedule migrations/tests and update study/subject setup workflows

backend/app/core/config.py

@@ -1,5 +1,5 @@
 from functools import lru_cache
-from typing import Literal
+from typing import Literal, Optional
 
 from pydantic import Field
 from pydantic_settings import BaseSettings, SettingsConfigDict
@@ -19,6 +19,11 @@ class Settings(BaseSettings):
     JWT_EXPIRE_MINUTES: int = 60
     JWT_EXTEND_GRACE_SECONDS: int = 120
     ABSOLUTE_SESSION_MAX_HOURS: int = 8
+    LOGIN_RSA_PRIVATE_KEY: Optional[str] = None
+    LOGIN_RSA_PUBLIC_KEY: Optional[str] = None
+    LOGIN_RSA_KEY_ID: str = "default"
+    LOGIN_CHALLENGE_TTL_SECONDS: int = 120
+    LOGIN_CHALLENGE_MAX_ACTIVE: int = 1000
 
 
 @lru_cache