chore: remove unused NEXT_PUBLIC_CLIENT_ID/SECRET env vars

The OAuth flow uses grant_type=mobile with a server-issued grant
(app/api/auth/token/route.js); no client_id/client_secret is sent at
runtime. These vars were dead — removed from Dockerfile args/env,
docker-compose, nixpacks, and docs. Also silences the Coolify
'variable not set' build warnings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CLAUDE.md

@@ -17,8 +17,6 @@ The dev script forces `HOST=yazd-nobat.localhost` so multi-domain detection work
 
 ```env
 NEXT_PUBLIC_API_URL=https://api.clinic-pro.ir   # Backend API base URL
-NEXT_PUBLIC_CLIENT_ID=...                        # OAuth client ID
-NEXT_PUBLIC_CLIENT_SECRET=...                    # OAuth client secret
 DEV_MODE=TRUE                                    # TRUE → blocks all crawlers + noindex
 ```