feat: harden auth and study workflows

- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads

- add login challenge replay protection, production RSA key validation, and auth tests

- wire compose to environment-driven dev/prod settings without committing local secrets

- update setup-config smoke scripts and Postman docs for encrypted login

- add visit schedule migrations/tests and update study/subject setup workflows

docs/postman/setup-config.postman_collection.json

@@ -6,7 +6,35 @@
   },
   "item": [
     {
-      "name": "1. 登录（获取 Token）",
+      "name": "1. 获取登录公钥",
+      "request": {
+        "method": "GET",
+        "header": [],
+        "url": {
+          "raw": "{{base_url}}/api/v1/auth/login-key",
+          "host": ["{{base_url}}"],
+          "path": ["api", "v1", "auth", "login-key"]
+        }
+      },
+      "event": [
+        {
+          "listen": "test",
+          "script": {
+            "type": "text/javascript",
+            "exec": [
+              "pm.test('status is 200', function () { pm.response.to.have.status(200); });",
+              "var json = pm.response.json();",
+              "pm.collectionVariables.set('login_key_id', json.key_id || '');",
+              "pm.collectionVariables.set('login_challenge', json.challenge || '');",
+              "pm.collectionVariables.set('login_public_key', json.public_key || '');",
+              "pm.collectionVariables.set('login_ciphertext', '<请生成 AES-GCM 密文，并用 login_public_key 通过 RSA-OAEP-SHA256 加密 AES key 后填写外层 Base64 envelope>');"
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "name": "2. 加密登录（获取 Token）",
       "request": {
         "method": "POST",
         "header": [
@@ -14,7 +42,7 @@
         ],
         "body": {
           "mode": "raw",
-          "raw": "{\n  \"email\": \"{{email}}\",\n  \"password\": \"{{password}}\"\n}"
+          "raw": "{\n  \"key_id\": \"{{login_key_id}}\",\n  \"challenge\": \"{{login_challenge}}\",\n  \"ciphertext\": \"{{login_ciphertext}}\"\n}"
         },
         "url": {
           "raw": "{{base_url}}/api/v1/auth/login",