fix: resolve critical bugs and security issues across the project

- Fix GPS map links always sending literal "latitude"/"longitude" strings
  instead of actual coordinates in openLocation/Content.js
- Add api.clinic-pro.ir to next.config.js remotePatterns so production
  images load correctly
- Fix appointment page: await params and getStateInfo (Next.js 15 pattern)
- Enable 401 handling in api.js: clear cookies and redirect to /login
- Move OAuth client_secret to server-side API routes (/api/auth/token,
  /api/auth/refresh) so it is never bundled into client-side JavaScript
- Update SendReq, SubmitData, ButtonSendData to call API routes instead
  of directly sending client_secret from the browser
- Update docker-compose.yml to use server-only CLIENT_SECRET env var
- Remove debug console.log from clinic doctors list component

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/auth/refresh/route.js

@@ -0,0 +1,31 @@
+import { NextResponse } from "next/server";
+
+export async function POST(request) {
+  const { refresh_token } = await request.json();
+
+  const API_URL = process.env.NEXT_PUBLIC_API_URL;
+  const CLIENT_ID = process.env.CLIENT_ID || process.env.NEXT_PUBLIC_CLIENT_ID;
+  const CLIENT_SECRET = process.env.CLIENT_SECRET || process.env.NEXT_PUBLIC_CLIENT_SECRET;
+
+  if (!refresh_token) {
+    return NextResponse.json({ error: "refresh_token is required" }, { status: 400 });
+  }
+
+  const formData = new URLSearchParams();
+  formData.append("grant_type", "refresh_token");
+  formData.append("client_id", CLIENT_ID);
+  formData.append("client_secret", CLIENT_SECRET);
+  formData.append("refresh_token", refresh_token);
+
+  try {
+    const res = await fetch(`${API_URL}/oauth/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded", Authorization: "" },
+      body: formData.toString(),
+    });
+    const data = await res.json();
+    return NextResponse.json(data, { status: res.status });
+  } catch {
+    return NextResponse.json({ error: "Refresh request failed" }, { status: 500 });
+  }
+}

app/api/auth/token/route.js

@@ -0,0 +1,33 @@
+import { NextResponse } from "next/server";
+
+export async function POST(request) {
+  const { uuid, code, scope = "nobat724" } = await request.json();
+
+  const API_URL = process.env.NEXT_PUBLIC_API_URL;
+  const CLIENT_ID = process.env.CLIENT_ID || process.env.NEXT_PUBLIC_CLIENT_ID;
+  const CLIENT_SECRET = process.env.CLIENT_SECRET || process.env.NEXT_PUBLIC_CLIENT_SECRET;
+
+  if (!uuid || !code) {
+    return NextResponse.json({ error: "uuid and code are required" }, { status: 400 });
+  }
+
+  const formData = new URLSearchParams();
+  formData.append("grant_type", "mobile");
+  formData.append("client_id", CLIENT_ID);
+  formData.append("client_secret", CLIENT_SECRET);
+  formData.append("uuid", uuid);
+  formData.append("code", code);
+  formData.append("scope", scope);
+
+  try {
+    const res = await fetch(`${API_URL}/oauth/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded", Authorization: "" },
+      body: formData.toString(),
+    });
+    const data = await res.json();
+    return NextResponse.json(data, { status: res.status });
+  } catch {
+    return NextResponse.json({ error: "Token request failed" }, { status: 500 });
+  }
+}