fix: resolve critical bugs and security issues across the project

- Fix GPS map links always sending literal "latitude"/"longitude" strings
  instead of actual coordinates in openLocation/Content.js
- Add api.clinic-pro.ir to next.config.js remotePatterns so production
  images load correctly
- Fix appointment page: await params and getStateInfo (Next.js 15 pattern)
- Enable 401 handling in api.js: clear cookies and redirect to /login
- Move OAuth client_secret to server-side API routes (/api/auth/token,
  /api/auth/refresh) so it is never bundled into client-side JavaScript
- Update SendReq, SubmitData, ButtonSendData to call API routes instead
  of directly sending client_secret from the browser
- Update docker-compose.yml to use server-only CLIENT_SECRET env var
- Remove debug console.log from clinic doctors list component

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

components/dashboard/userAccount/detailUser/information/ButtonSendData.js

@@ -29,26 +29,22 @@ function ButtonSendData({
       .postUserProfile(changeDateType(information, false))
       .then((response) => {
         if (response.uuid) {
-          const formData = new URLSearchParams();
-          formData.append("grant_type", "refresh_token");
-          formData.append("client_id", process.env.NEXT_PUBLIC_CLIENT_ID);
-          formData.append(
-            "client_secret",
-            process.env.NEXT_PUBLIC_CLIENT_SECRET
-          );
-          formData.append("refresh_token", Cookies.get("refresh_token"));
-
-          request
-            .postRefreshToken(formData)
+          fetch("/api/auth/refresh", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ refresh_token: Cookies.get("refresh_token") }),
+          })
+            .then((r) => r.json())
             .then((res) => {
-              const expiresTime = handleTimeExpiresToken(res.expires_in);
-              Cookies.set("access_token", res.access_token, {
-                expires: expiresTime.accessTokenExpires,
-                path: "/",
-                secure: true,
-                sameSite: "strict",
-              });
-
+              if (res?.access_token) {
+                const expiresTime = handleTimeExpiresToken(res.expires_in);
+                Cookies.set("access_token", res.access_token, {
+                  expires: expiresTime.accessTokenExpires,
+                  path: "/",
+                  secure: true,
+                  sameSite: "strict",
+                });
+              }
               setInformation({
                 ...information,
                 prev_data: true,
@@ -56,7 +52,7 @@ function ButtonSendData({
               });
               setLoading(false);
             })
-            .catch((err) => {
+            .catch(() => {
               setLoading(false);
             });
         }