fix: resolve critical bugs and security issues across the project

- Fix GPS map links always sending literal "latitude"/"longitude" strings
  instead of actual coordinates in openLocation/Content.js
- Add api.clinic-pro.ir to next.config.js remotePatterns so production
  images load correctly
- Fix appointment page: await params and getStateInfo (Next.js 15 pattern)
- Enable 401 handling in api.js: clear cookies and redirect to /login
- Move OAuth client_secret to server-side API routes (/api/auth/token,
  /api/auth/refresh) so it is never bundled into client-side JavaScript
- Update SendReq, SubmitData, ButtonSendData to call API routes instead
  of directly sending client_secret from the browser
- Update docker-compose.yml to use server-only CLIENT_SECRET env var
- Remove debug console.log from clinic doctors list component

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

components/register/verificationPage/SendReq.js

@@ -14,23 +14,23 @@ function SendReq({
 }) {
   const handleReq = async () => {
     setLoading(true);
-    request
-      .getToken(
-        "mobile",
-        process.env.NEXT_PUBLIC_CLIENT_ID,
-        process.env.NEXT_PUBLIC_CLIENT_SECRET,
-        uuid,
-        code.join("")
-      )
-      .then((response) => {
-        if (response.access_token) {
-          handleSetCookie(response);
-        }
-      })
-      .catch(() => {
+    try {
+      const res = await fetch("/api/auth/token", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ uuid, code: code.join("") }),
+      });
+      const response = await res.json();
+      if (response.access_token) {
+        handleSetCookie(response);
+      } else {
         setLoading(false);
         setIsError(true);
-      });
+      }
+    } catch {
+      setLoading(false);
+      setIsError(true);
+    }
   };
 
   const handleSetCookie = (response) => {