fix(geoportal-v2): UAT click deep-links to eterra.live + revert debug

UAT click previously console.logged only. gis-api search response
doesn't include bbox/centroid, so ArchiTools can't fitBounds locally.
Reuse the deep-link pattern (already used by Export GeoPackage) →
open eterra.live/harta?siruta=X in a new tab. eterra.live has its own
/api/geoportal/uat-bounds + flyTo wired.

Future: add GET /api/v1/uat/:siruta/bounds to gis-api so ArchiTools
can fitBounds inline without leaving the page.

Also reverts the session.debug diagnostic (Marius confirmed
hasRefreshToken=true + expiresIn=293 after attaching offline_access
scope mapping to Authentik provider pk=6 — root cause fixed,
diagnostic no longer needed).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/core/auth/auth-options.ts

@@ -161,16 +161,6 @@ export const authOptions: NextAuthOptions = {
       (session as any).accessToken = token.accessToken;
       // Surface refresh failure so the client can force a re-login UX.
       if (token.error) (session as any).error = token.error;
-      // Temporary diagnostic — confirms whether jwt callback captured a
-      // refresh_token + expiry on sign-in. Reveal counts/booleans only,
-      // never the actual tokens.
-      (session as any).debug = {
-        hasRefreshToken: !!token.refreshToken,
-        accessTokenExpiresIn:
-          typeof token.accessTokenExpires === "number"
-            ? Math.round((token.accessTokenExpires - Date.now()) / 1000)
-            : null,
-      };
       // Faza C cutover flag — exposed on session so client components can
       // branch the same way server routes do (env-driven, evaluated per
       // request so flag flip + container restart picks up without rebuild).