feat: harden auth and study workflows

- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads

- add login challenge replay protection, production RSA key validation, and auth tests

- wire compose to environment-driven dev/prod settings without committing local secrets

- update setup-config smoke scripts and Postman docs for encrypted login

- add visit schedule migrations/tests and update study/subject setup workflows

backend/app/schemas/study_setup_config.py

@@ -2,7 +2,7 @@ import uuid
 from datetime import datetime
 from typing import Literal
 
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, ConfigDict, Field, model_validator
 
 
 ConfirmStatus = Literal["待确认", "已确认", "退回"]
@@ -143,6 +143,13 @@ class SetupProjectionSummary(BaseModel):
     skipped_items: list[SetupProjectionSkippedItem] = Field(default_factory=list)
 
 
+class VisitScheduleItem(BaseModel):
+    visit_code: str = Field(min_length=1, max_length=50)
+    baseline_offset_days: int = Field(ge=0, le=3650)
+    window_before_days: int = Field(ge=0, le=365)
+    window_after_days: int = Field(ge=0, le=365)
+
+
 class ProjectPublishSnapshot(BaseModel):
     code: str = ""
     name: str = ""
@@ -162,13 +169,21 @@ class ProjectPublishSnapshot(BaseModel):
     plan_end_date: str = ""
     planned_site_count: int | None = None
     planned_enrollment_count: int | None = None
-    summary_note: str = ""
-    objective_note: str = ""
     status: str = ""
-    visit_interval_days: int | None = None
-    visit_total: int | None = None
-    visit_window_start_offset: int | None = None
-    visit_window_end_offset: int | None = None
+    visit_schedule: list[VisitScheduleItem] = Field(default_factory=list)
+
+    @model_validator(mode="after")
+    def validate_visit_schedule(self):
+        codes: set[str] = set()
+        for index, item in enumerate(self.visit_schedule):
+            code = item.visit_code.strip()
+            if not code:
+                raise ValueError(f"第 {index + 1} 行访视编号不能为空")
+            if code in codes:
+                raise ValueError(f"访视编号重复：{code}")
+            codes.add(code)
+            item.visit_code = code
+        return self
 
 
 class StudySetupConfigRead(BaseModel):