fix(auth): align token/refresh routes with clinicpro 3-step OTP flow

backend جدید clinicpro جریان سه‌مرحله‌ای دارد:
send-code → verify-code (uuid+code) → oauth/token (uuid).
- token route حالا اول /api/v1/user/verify-code را صدا می‌زند سپس
  /oauth/token با بدنه JSON {grant_type, uuid} (به‌جای form-urlencoded
  با client_id/secret/scope که فقط backend پروداکشن قدیم می‌پذیرفت)
- refresh route به مسیر درست /oauth/token/refresh با بدنه JSON
- تست E2E روی ddev محلی: access_token واقعی صادر شد

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/auth/refresh/route.js

@@ -5,25 +5,17 @@ export async function POST(request) {
   const { refresh_token } = await request.json();
 
   const API_URL = process.env.NEXT_PUBLIC_API_URL;
-  const CLIENT_ID = process.env.CLIENT_ID || process.env.NEXT_PUBLIC_CLIENT_ID;
-  const CLIENT_SECRET = process.env.CLIENT_SECRET || process.env.NEXT_PUBLIC_CLIENT_SECRET;
 
   if (!refresh_token) {
     return NextResponse.json({ error: "refresh_token is required" }, { status: 400 });
   }
 
-  const formData = new URLSearchParams();
-  formData.append("grant_type", "refresh_token");
-  formData.append("client_id", CLIENT_ID);
-  formData.append("client_secret", CLIENT_SECRET);
-  formData.append("refresh_token", refresh_token);
-
   try {
     const res = await axiosInstance.post(
-      `${API_URL}/oauth/token`,
+      `${API_URL}/oauth/token/refresh`,
-      formData.toString(),
+      { refresh_token },
       {
-        headers: { "Content-Type": "application/x-www-form-urlencoded", Authorization: "" },
+        headers: { "Content-Type": "application/json", Authorization: "" },
       }
     );
     return NextResponse.json(res.data, { status: res.status });

app/api/auth/token/route.js

@@ -2,31 +2,29 @@ import { NextResponse } from "next/server";
 import { axiosInstance } from "@/lib/req";
 
 export async function POST(request) {
-  const { uuid, code, scope = "nobat724" } = await request.json();
+  const { uuid, code } = await request.json();
 
   const API_URL = process.env.NEXT_PUBLIC_API_URL;
-  const CLIENT_ID = process.env.CLIENT_ID || process.env.NEXT_PUBLIC_CLIENT_ID;
-  const CLIENT_SECRET = process.env.CLIENT_SECRET || process.env.NEXT_PUBLIC_CLIENT_SECRET;
 
   if (!uuid || !code) {
     return NextResponse.json({ error: "uuid and code are required" }, { status: 400 });
   }
 
-  const formData = new URLSearchParams();
+  const jsonHeaders = { "Content-Type": "application/json", Authorization: "" };
-  formData.append("grant_type", "mobile");
-  formData.append("client_id", CLIENT_ID);
-  formData.append("client_secret", CLIENT_SECRET);
-  formData.append("uuid", uuid);
-  formData.append("code", code);
-  formData.append("scope", scope);
 
   try {
+    // مرحله ۱: تأیید OTP — بدون این، oauth/token کد را verified نمی‌بیند
+    await axiosInstance.post(
+      `${API_URL}/api/v1/user/verify-code`,
+      { uuid, code },
+      { headers: jsonHeaders }
+    );
+
+    // مرحله ۲: تبدیل uuid تأییدشده به توکن
     const res = await axiosInstance.post(
       `${API_URL}/oauth/token`,
-      formData.toString(),
+      { grant_type: "mobile", uuid },
-      {
+      { headers: jsonHeaders }
-        headers: { "Content-Type": "application/x-www-form-urlencoded", Authorization: "" },
-      }
     );
     return NextResponse.json(res.data, { status: res.status });
   } catch (error) {