feat: harden auth and study workflows

- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads

- add login challenge replay protection, production RSA key validation, and auth tests

- wire compose to environment-driven dev/prod settings without committing local secrets

- update setup-config smoke scripts and Postman docs for encrypted login

- add visit schedule migrations/tests and update study/subject setup workflows

backend/app/crud/subject.py

@@ -1,5 +1,5 @@
 import uuid
-from datetime import date, timedelta
+from datetime import date
 from typing import Sequence
 
 from sqlalchemy import delete as sa_delete, select, update as sa_update
@@ -37,6 +37,10 @@ def _validate_subject_date_chain(
         raise ValueError("完成日期不能早于入组日期")
 
 
+def _should_sync_visits(previous_baseline_date: date | None, next_baseline_date: date | None) -> bool:
+    return next_baseline_date is not None and previous_baseline_date != next_baseline_date
+
+
 async def _validate_site(db: AsyncSession, study_id: uuid.UUID, site_id: uuid.UUID) -> None:
     result = await db.execute(select(Site).where(Site.id == site_id))
     site = result.scalar_one_or_none()
@@ -51,7 +55,7 @@ async def create_subject(db: AsyncSession, study_id: uuid.UUID, subject_in: Subj
     _validate_subject_date_chain(
         screening_date=subject_in.screening_date,
         consent_date=subject_in.consent_date,
-        enrollment_date=None,
+        enrollment_date=subject_in.enrollment_date,
         completion_date=None,
     )
     subject = Subject(
@@ -61,7 +65,8 @@ async def create_subject(db: AsyncSession, study_id: uuid.UUID, subject_in: Subj
         status="SCREENING",
         screening_date=subject_in.screening_date,
         consent_date=subject_in.consent_date,
-        enrollment_date=None,
+        enrollment_date=subject_in.enrollment_date,
+        baseline_date=subject_in.baseline_date,
         completion_date=None,
         drop_reason=None,
     )
@@ -69,15 +74,7 @@ async def create_subject(db: AsyncSession, study_id: uuid.UUID, subject_in: Subj
     await db.commit()
     await db.refresh(subject)
 
-    # initial visit: Screening (V0)
-    await visit_crud.create_visit(
-        db,
-        study_id=study_id,
-        visit_in=None,
-        subject=subject,
-        visit_code="V0",
-        planned_date=subject.screening_date,
-    )
+    await sync_visits_from_baseline(db, subject)
     return subject
 
 
@@ -103,49 +100,26 @@ async def list_subjects(
     return result.scalars().all()
 
 
-async def generate_default_visits(db: AsyncSession, subject: Subject) -> None:
-    # Baseline + Follow-up visits based on enrollment_date
-    if not subject.enrollment_date:
-        return
+async def sync_visits_from_baseline(db: AsyncSession, subject: Subject) -> None:
+    # 基线/治疗日期是访视计划的唯一推算基准，不能用入组日期替代。
     result = await db.execute(select(Study).where(Study.id == subject.study_id))
     study = result.scalar_one_or_none()
     if not study:
         return
 
-    visit_total = study.visit_total or 3
-    visit_interval_days = study.visit_interval_days or 30
-    window_start_offset = study.visit_window_start_offset
-    window_end_offset = study.visit_window_end_offset
-    baseline_date = subject.enrollment_date
-
-    result = await db.execute(select(Visit.visit_code).where(Visit.subject_id == subject.id))
-    existing_codes = {row[0] for row in result.all()}
-    if "V1" not in existing_codes:
-        window_start = baseline_date + timedelta(days=window_start_offset) if window_start_offset is not None else None
-        window_end = baseline_date + timedelta(days=window_end_offset) if window_end_offset is not None else None
-        await visit_crud.create_visit(
-            db,
-            study_id=subject.study_id,
-            visit_in=None,
-            subject=subject,
-            visit_code="V1",
-            planned_date=baseline_date,
-            window_start=window_start,
-            window_end=window_end,
-        )
-
-    await visit_crud.create_followup_visits(
+    await visit_crud.create_scheduled_visits(
         db,
         study_id=subject.study_id,
         subject=subject,
-        base_date=baseline_date,
-        visit_total=visit_total,
-        visit_interval_days=visit_interval_days,
-        window_start_offset=window_start_offset,
-        window_end_offset=window_end_offset,
+        base_date=subject.baseline_date,
+        visit_schedule=study.visit_schedule,
     )
 
 
+async def generate_default_visits(db: AsyncSession, subject: Subject) -> None:
+    await sync_visits_from_baseline(db, subject)
+
+
 async def update_subject(db: AsyncSession, subject: Subject, subject_in: SubjectUpdate) -> Subject:
     update_data = subject_in.model_dump(exclude_unset=True)
     next_screening_date = subject.screening_date
@@ -169,6 +143,14 @@ async def update_subject(db: AsyncSession, subject: Subject, subject_in: Subject
     return subject
 
 
+def should_generate_visits_after_subject_update(
+    *,
+    previous_baseline_date: date | None,
+    next_baseline_date: date | None,
+) -> bool:
+    return _should_sync_visits(previous_baseline_date, next_baseline_date)
+
+
 async def delete_subject(db: AsyncSession, subject: Subject) -> None:
     subject_id = subject.id
     await db.execute(sa_delete(Visit).where(Visit.subject_id == subject_id))