fix: resolve critical bugs and security issues across the project

- Fix GPS map links always sending literal "latitude"/"longitude" strings
  instead of actual coordinates in openLocation/Content.js
- Add api.clinic-pro.ir to next.config.js remotePatterns so production
  images load correctly
- Fix appointment page: await params and getStateInfo (Next.js 15 pattern)
- Enable 401 handling in api.js: clear cookies and redirect to /login
- Move OAuth client_secret to server-side API routes (/api/auth/token,
  /api/auth/refresh) so it is never bundled into client-side JavaScript
- Update SendReq, SubmitData, ButtonSendData to call API routes instead
  of directly sending client_secret from the browser
- Update docker-compose.yml to use server-only CLIENT_SECRET env var
- Remove debug console.log from clinic doctors list component

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/api.js

@@ -34,10 +34,12 @@ api.interceptors.response.use(
     return response.data;
   },
   (error) => {
-    // if (error.status === 401) {
-    //   removeToken();
-    //   window.location.pathname = "login";
-    // }
+    if (error?.response?.status === 401 && typeof window !== "undefined") {
+      ["access_token", "refresh_token", "uuid", "userInfo"].forEach((key) => {
+        document.cookie = `${key}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;`;
+      });
+      window.location.href = "/login";
+    }
     return Promise.reject(error);
   }
 );