feat: harden auth and study workflows

- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads

- add login challenge replay protection, production RSA key validation, and auth tests

- wire compose to environment-driven dev/prod settings without committing local secrets

- update setup-config smoke scripts and Postman docs for encrypted login

- add visit schedule migrations/tests and update study/subject setup workflows

docs/guides/setup-config-api.md

@@ -104,13 +104,21 @@
     "plan_end_date": "2026-12-31",
     "planned_site_count": 12,
     "planned_enrollment_count": 120,
-    "summary_note": "",
-    "objective_note": "",
     "status": "DRAFT",
-    "visit_interval_days": null,
-    "visit_total": null,
-    "visit_window_start_offset": null,
-    "visit_window_end_offset": null
+    "visit_schedule": [
+      {
+        "visit_code": "基线访视",
+        "baseline_offset_days": 0,
+        "window_before_days": 0,
+        "window_after_days": 0
+      },
+      {
+        "visit_code": "V1",
+        "baseline_offset_days": 7,
+        "window_before_days": 2,
+        "window_after_days": 2
+      }
+    ]
   },
   "saved_by": "11111111-1111-1111-1111-111111111111",
   "saved_by_name": "System Admin",