chore: remove unused NEXT_PUBLIC_CLIENT_ID/SECRET env vars

The OAuth flow uses grant_type=mobile with a server-issued grant
(app/api/auth/token/route.js); no client_id/client_secret is sent at
runtime. These vars were dead — removed from Dockerfile args/env,
docker-compose, nixpacks, and docs. Also silences the Coolify
'variable not set' build warnings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.yml

@@ -38,9 +38,6 @@ services:
       # API configuration
       NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
       DEV_MODE: ${DEV_MODE:-FALSE}
-      # Server-only OAuth credentials (not exposed to browser)
-      CLIENT_ID: ${CLIENT_ID:-${NEXT_PUBLIC_CLIENT_ID}}
-      CLIENT_SECRET: ${CLIENT_SECRET:-${NEXT_PUBLIC_CLIENT_SECRET}}
 
     # Health check (uses Dockerfile HEALTHCHECK)
     healthcheck: