fix: resolve critical bugs and security issues across the project

- Fix GPS map links always sending literal "latitude"/"longitude" strings
  instead of actual coordinates in openLocation/Content.js
- Add api.clinic-pro.ir to next.config.js remotePatterns so production
  images load correctly
- Fix appointment page: await params and getStateInfo (Next.js 15 pattern)
- Enable 401 handling in api.js: clear cookies and redirect to /login
- Move OAuth client_secret to server-side API routes (/api/auth/token,
  /api/auth/refresh) so it is never bundled into client-side JavaScript
- Update SendReq, SubmitData, ButtonSendData to call API routes instead
  of directly sending client_secret from the browser
- Update docker-compose.yml to use server-only CLIENT_SECRET env var
- Remove debug console.log from clinic doctors list component

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

components/appointment/detail/SubmitData.js

@@ -12,17 +12,14 @@ function SubmitData({ setStep, data, prevData, setErrors, doctor, selectedSlot,
   const refreshAccessToken = async () => {
     try {
       const refreshToken = Cookies.get("refresh_token");
-      if (!refreshToken) {
-        return false;
-      }
+      if (!refreshToken) return false;
 
-      const formData = new URLSearchParams();
-      formData.append("grant_type", "refresh_token");
-      formData.append("client_id", process.env.NEXT_PUBLIC_CLIENT_ID || "4gSZTqkcM-13yfCHptFjsIoEzwA996bjGuSEFy02Dkc");
-      formData.append("client_secret", process.env.NEXT_PUBLIC_CLIENT_SECRET || "13yfCHptFjsIoEzwA996bjGuSEFy02Dkc");
-      formData.append("refresh_token", refreshToken);
-
-      const response = await request.postRefreshToken(formData);
+      const res = await fetch("/api/auth/refresh", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ refresh_token: refreshToken }),
+      });
+      const response = await res.json();
 
       if (response?.access_token) {
         Cookies.set("access_token", response.access_token, { expires: 7 });
@@ -32,7 +29,7 @@ function SubmitData({ setStep, data, prevData, setErrors, doctor, selectedSlot,
         return true;
       }
       return false;
-    } catch (error) {
+    } catch {
       return false;
     }
   };