fix(geoportal-v2): UAT click deep-links to eterra.live + revert debug

UAT click previously console.logged only. gis-api search response
doesn't include bbox/centroid, so ArchiTools can't fitBounds locally.
Reuse the deep-link pattern (already used by Export GeoPackage) →
open eterra.live/harta?siruta=X in a new tab. eterra.live has its own
/api/geoportal/uat-bounds + flyTo wired.

Future: add GET /api/v1/uat/:siruta/bounds to gis-api so ArchiTools
can fitBounds inline without leaving the page.

Also reverts the session.debug diagnostic (Marius confirmed
hasRefreshToken=true + expiresIn=293 after attaching offline_access
scope mapping to Authentik provider pk=6 — root cause fixed,
diagnostic no longer needed).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/core/auth/auth-options.ts

@@ -161,16 +161,6 @@ export const authOptions: NextAuthOptions = {
       (session as any).accessToken = token.accessToken;
       // Surface refresh failure so the client can force a re-login UX.
       if (token.error) (session as any).error = token.error;
-      // Temporary diagnostic — confirms whether jwt callback captured a
-      // refresh_token + expiry on sign-in. Reveal counts/booleans only,
-      // never the actual tokens.
-      (session as any).debug = {
-        hasRefreshToken: !!token.refreshToken,
-        accessTokenExpiresIn:
-          typeof token.accessTokenExpires === "number"
-            ? Math.round((token.accessTokenExpires - Date.now()) / 1000)
-            : null,
-      };
       // Faza C cutover flag — exposed on session so client components can
       // branch the same way server routes do (env-driven, evaluated per
       // request so flag flip + container restart picks up without rebuild).

src/modules/geoportal/v2/geoportal-v2.tsx

@@ -32,9 +32,12 @@ export function GeoportalV2() {
   }, []);
 
   const handleUatSelect = useCallback((uat: UatHit) => {
-    // Search response doesn't carry bbox/centroid yet — leave panel + let user pan.
-    // Future: enrich search response with uat bounding box, then flyTo.
-    console.info("UAT selected:", uat.siruta, uat.name);
+    // gis-api search doesn't return UAT bounds today, so we can't flyTo
+    // server-side. Workaround: deep-link to eterra.live/harta which has
+    // bbox lookup (their /api/geoportal/uat-bounds + flyTo). Future:
+    // add GET /api/v1/uat/:siruta/bounds to gis-api and fitBounds here.
+    const url = `https://eterra.live/harta?siruta=${encodeURIComponent(uat.siruta)}`;
+    window.open(url, "_blank", "noopener,noreferrer");
   }, []);
 
   const handleFeatureSelect = useCallback((f: FeatureHit) => {