While there is no good reason to not use TLS to safeguard this, your approach seems okay and here is why:
The computational complexity of hashing sha 256 and encrypting it with (asymmetrical or hybrid) algorithms is fairly high; there is (currently) no feasible way to brute force that if the passwords are reasonably strong.
Additionally, if you are worried about brute force, you can ban an IP for x hours if the password is entered wrong y times in a row - like fail2ban does - and/or add additional time between logins like GNU/Linux does.
That being said: there is a perfectly good way to authenticate users securely and that is TLS.
To address your trying to encrypt the public key with symmetric encryption: there is no gain in that. If you use reasonably strong key pairs, it should be computationally infeasible to generate the private key from the public key - asymmetric crypto systems are designed in such a way that public keys are meant to be public (hence the name!).
Adding a layer of AES wouldn’t harm that in any way, but introduce additional problems: the client can be reversed to get the key and render your attempt useless - and can be debugged to retrieve the symmetric and/or public key from memory. Also, you add more complexity to your software, increasing the likelihood of failure and error without a benefit.