feat: harden auth and study workflows

- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads

- add login challenge replay protection, production RSA key validation, and auth tests

- wire compose to environment-driven dev/prod settings without committing local secrets

- update setup-config smoke scripts and Postman docs for encrypted login

- add visit schedule migrations/tests and update study/subject setup workflows

frontend/src/utils/auth.ts

@@ -1,5 +1,4 @@
 const TOKEN_KEY = "ctms_token";
-const CREDENTIAL_KEY = "ctms_credential";
 
 export const getToken = (): string | null => localStorage.getItem(TOKEN_KEY);
 
@@ -10,30 +9,3 @@ export const setToken = (token: string): void => {
 export const clearToken = (): void => {
   localStorage.removeItem(TOKEN_KEY);
 };
-
-export const setCachedCredential = (email: string, password: string) => {
-  try {
-    const payload = btoa(JSON.stringify({ email, password }));
-    localStorage.setItem(CREDENTIAL_KEY, payload);
-  } catch {
-    /* ignore */
-  }
-};
-
-export const getCachedCredential = (): { email: string; password: string } | null => {
-  const value = localStorage.getItem(CREDENTIAL_KEY);
-  if (!value) return null;
-  try {
-    const parsed = JSON.parse(atob(value));
-    if (parsed?.email && parsed?.password) {
-      return { email: parsed.email, password: parsed.password };
-    }
-  } catch {
-    /* ignore */
-  }
-  return null;
-};
-
-export const clearCachedCredential = (): void => {
-  localStorage.removeItem(CREDENTIAL_KEY);
-};