feat: harden auth and study workflows

- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads

- add login challenge replay protection, production RSA key validation, and auth tests

- wire compose to environment-driven dev/prod settings without committing local secrets

- update setup-config smoke scripts and Postman docs for encrypted login

- add visit schedule migrations/tests and update study/subject setup workflows

backend/app/crud/study.py

@@ -30,14 +30,9 @@ async def create(db: AsyncSession, study_in: StudyCreate, *, created_by: uuid.UU
         planned_enrollment_count=study_in.planned_enrollment_count,
         enrollment_monthly_goal_note=study_in.enrollment_monthly_goal_note,
         enrollment_stage_breakdown=study_in.enrollment_stage_breakdown,
-        summary_note=study_in.summary_note,
-        objective_note=study_in.objective_note,
         phase=study_in.phase,
         status=study_in.status,
-        visit_interval_days=study_in.visit_interval_days,
-        visit_total=study_in.visit_total,
-        visit_window_start_offset=study_in.visit_window_start_offset,
-        visit_window_end_offset=study_in.visit_window_end_offset,
+        visit_schedule=[item.model_dump() for item in study_in.visit_schedule],
         created_by=created_by,
     )
     db.add(study)