fix: resolve critical bugs and security issues across the project

Security:
- Disable SSL verification only in development (lib/req.js)
- Wrap all JSON.parse(cookie) calls in try-catch via safeJsonParse utility
- Sanitize dangerouslySetInnerHTML in blog/clinic with sanitizeHtml utility
- Fix open redirect in payment page — validate URL origin before redirect
- Fix cookie cleanup on 401 — use js-cookie with correct domain scope

Performance:
- Wrap ItemDoctor with React.memo to prevent unnecessary re-renders
- Replace <img> with Next.js <Image> in blog Caption component

Functionality:
- Fix memory leak in Recode.js — store intervals in refs, cleanup on unmount
- Add null guard on retryIcon.current before classList manipulation
- Fix getParsedUserInfo in helper to handle malformed cookie gracefully

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/api.js

@@ -1,6 +1,5 @@
 import axios from "axios";
 import Cookies from "js-cookie";
-import "react-toastify/dist/ReactToastify.css";
 
 const BASE_URL = process.env.NEXT_PUBLIC_API_URL;
 
@@ -35,8 +34,13 @@ api.interceptors.response.use(
   },
   (error) => {
     if (error?.response?.status === 401 && typeof window !== "undefined") {
+      const hostname = window.location.hostname;
+      const domain = hostname.includes("localhost")
+        ? undefined
+        : `.${hostname.split(".").slice(-2).join(".")}`;
+      const opts = { path: "/", ...(domain && { domain }) };
       ["access_token", "refresh_token", "uuid", "userInfo"].forEach((key) => {
-        document.cookie = `${key}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;`;
+        Cookies.remove(key, opts);
       });
       window.location.href = "/login";
     }