feat: harden auth and study workflows

- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads

- add login challenge replay protection, production RSA key validation, and auth tests

- wire compose to environment-driven dev/prod settings without committing local secrets

- update setup-config smoke scripts and Postman docs for encrypted login

- add visit schedule migrations/tests and update study/subject setup workflows

frontend/src/session/sessionManager.ts

@@ -2,7 +2,8 @@ import router from "../router";
 import { useAuthStore } from "../store/auth";
 import { useSessionStore } from "../store/session";
 import { getToken, setToken, clearToken } from "../utils/auth";
-import { extendToken, unlockSession } from "../api/authClient";
+import { extendToken, getLoginKey, unlockSession } from "../api/authClient";
+import { encryptLoginPayload } from "../utils/loginCrypto";
 import { parseJwtExp } from "./jwt";
 
 export const IDLE_TIMEOUT_MINUTES = 30;
@@ -292,7 +293,17 @@ export const startTokenKeepAlive = () => {
 export const unlockWithPassword = async (email: string, password: string) => {
   const session = useSessionStore();
   const auth = useAuthStore();
-  const { data } = await unlockSession({ email, password });
+  const { data: loginKey } = await getLoginKey();
+  const ciphertext = await encryptLoginPayload(loginKey.public_key, {
+    email,
+    password,
+    challenge: loginKey.challenge,
+  });
+  const { data } = await unlockSession({
+    key_id: loginKey.key_id,
+    challenge: loginKey.challenge,
+    ciphertext,
+  });
   updateToken(data.accessToken);
   session.unlock();
   try {