feat: harden auth and study workflows

- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads

- add login challenge replay protection, production RSA key validation, and auth tests

- wire compose to environment-driven dev/prod settings without committing local secrets

- update setup-config smoke scripts and Postman docs for encrypted login

- add visit schedule migrations/tests and update study/subject setup workflows

backend/app/schemas/subject.py

@@ -10,12 +10,15 @@ class SubjectCreate(BaseModel):
     subject_no: str
     screening_date: Optional[date] = None
     consent_date: Optional[date] = None
+    enrollment_date: Optional[date] = None
+    baseline_date: Optional[date] = None
 
 
 class SubjectUpdate(BaseModel):
     status: Optional[str] = None
     consent_date: Optional[date] = None
     enrollment_date: Optional[date] = None
+    baseline_date: Optional[date] = None
     completion_date: Optional[date] = None
     drop_reason: Optional[str] = None
 
@@ -29,6 +32,7 @@ class SubjectRead(BaseModel):
     screening_date: Optional[date]
     consent_date: Optional[date]
     enrollment_date: Optional[date]
+    baseline_date: Optional[date]
     completion_date: Optional[date]
     drop_reason: Optional[str]
     created_at: datetime