fix: resolve critical bugs and security issues across the project

- Fix GPS map links always sending literal "latitude"/"longitude" strings
  instead of actual coordinates in openLocation/Content.js
- Add api.clinic-pro.ir to next.config.js remotePatterns so production
  images load correctly
- Fix appointment page: await params and getStateInfo (Next.js 15 pattern)
- Enable 401 handling in api.js: clear cookies and redirect to /login
- Move OAuth client_secret to server-side API routes (/api/auth/token,
  /api/auth/refresh) so it is never bundled into client-side JavaScript
- Update SendReq, SubmitData, ButtonSendData to call API routes instead
  of directly sending client_secret from the browser
- Update docker-compose.yml to use server-only CLIENT_SECRET env var
- Remove debug console.log from clinic doctors list component

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -37,9 +37,10 @@ services:
 
       # API configuration
       NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
-      NEXT_PUBLIC_CLIENT_ID: ${NEXT_PUBLIC_CLIENT_ID}
-      NEXT_PUBLIC_CLIENT_SECRET: ${NEXT_PUBLIC_CLIENT_SECRET}
       DEV_MODE: ${DEV_MODE:-FALSE}
+      # Server-only OAuth credentials (not exposed to browser)
+      CLIENT_ID: ${CLIENT_ID:-${NEXT_PUBLIC_CLIENT_ID}}
+      CLIENT_SECRET: ${CLIENT_SECRET:-${NEXT_PUBLIC_CLIENT_SECRET}}
 
     # Health check (uses Dockerfile HEALTHCHECK)
     healthcheck: