feat: harden auth and study workflows

- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads

- add login challenge replay protection, production RSA key validation, and auth tests

- wire compose to environment-driven dev/prod settings without committing local secrets

- update setup-config smoke scripts and Postman docs for encrypted login

- add visit schedule migrations/tests and update study/subject setup workflows

backend/app/schemas/user.py

@@ -23,7 +23,7 @@ class UserDisplay(BaseModel):
 
 
 class _PasswordValidator(BaseModel):
-    password: Optional[str] = Field(default=None, min_length=8)
+    password: Optional[str] = Field(default=None, min_length=8, max_length=72)
 
     @field_validator("password")
     @classmethod
@@ -36,7 +36,7 @@ class _PasswordValidator(BaseModel):
 
 
 class UserRegisterRequest(_PasswordValidator):
-    password: str = Field(min_length=8)
+    password: str = Field(min_length=8, max_length=72)
     email: EmailStr
     full_name: str = Field(min_length=1)
     role: RegisterRole
@@ -44,7 +44,7 @@ class UserRegisterRequest(_PasswordValidator):
 
 
 class UserCreate(_PasswordValidator):
-    password: str = Field(min_length=8)
+    password: str = Field(min_length=8, max_length=72)
     email: EmailStr
     full_name: str = Field(min_length=1)
     role: UserRole