feat: harden auth and study workflows

- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads

- add login challenge replay protection, production RSA key validation, and auth tests

- wire compose to environment-driven dev/prod settings without committing local secrets

- update setup-config smoke scripts and Postman docs for encrypted login

- add visit schedule migrations/tests and update study/subject setup workflows

docker-compose.yaml

@@ -30,6 +30,10 @@ services:
       - "8000:8000"
     environment:
       DATABASE_URL: postgresql+asyncpg://ctms_user:secret_password@db/ctms_db
+      ENV: ${ENV:-development}
+      JWT_SECRET_KEY: ${JWT_SECRET_KEY:-dev-secret}
+      LOGIN_RSA_PRIVATE_KEY: ${LOGIN_RSA_PRIVATE_KEY:-}
+      LOGIN_RSA_KEY_ID: ${LOGIN_RSA_KEY_ID:-default}
     depends_on:
       db:
         condition: service_healthy
@@ -43,6 +47,10 @@ services:
     command: python scripts/init_production.py
     environment:
       DATABASE_URL: postgresql+asyncpg://ctms_user:secret_password@db/ctms_db
+      ENV: ${ENV:-development}
+      JWT_SECRET_KEY: ${JWT_SECRET_KEY:-dev-secret}
+      LOGIN_RSA_PRIVATE_KEY: ${LOGIN_RSA_PRIVATE_KEY:-}
+      LOGIN_RSA_KEY_ID: ${LOGIN_RSA_KEY_ID:-default}
     depends_on:
       db:
         condition: service_healthy