chore: remove unused NEXT_PUBLIC_CLIENT_ID/SECRET env vars

The OAuth flow uses grant_type=mobile with a server-issued grant
(app/api/auth/token/route.js); no client_id/client_secret is sent at
runtime. These vars were dead — removed from Dockerfile args/env,
docker-compose, nixpacks, and docs. Also silences the Coolify
'variable not set' build warnings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Dockerfile

@@ -36,14 +36,10 @@ WORKDIR /app
 
 # Build-time arguments (Coolify: set these as Build Variables)
 ARG NEXT_PUBLIC_API_URL
-ARG NEXT_PUBLIC_CLIENT_ID
-ARG NEXT_PUBLIC_CLIENT_SECRET
 ARG DEV_MODE=FALSE
 
 # Expose them to `next build`
 ENV NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL
-ENV NEXT_PUBLIC_CLIENT_ID=$NEXT_PUBLIC_CLIENT_ID
-ENV NEXT_PUBLIC_CLIENT_SECRET=$NEXT_PUBLIC_CLIENT_SECRET
 ENV DEV_MODE=$DEV_MODE
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV NODE_ENV=production