[Onboarding] Build cold-start preferences from GitHub activity and remove default-selection bias

## Problem

GitHub sync currently imports basic account metadata but not the strongest cold-start recommendation signals such as starred repositories, owned repositories, contributions, organizations, topics, and language history:

- https://github.com/ACM-VIT/gh-social/blob/49073fc71423aa8e10334158d70ac6d41be1dbc0/backend/services/onboardingService.ts#L80-L135

The onboarding UI also preselects five technologies for every user:

- https://github.com/ACM-VIT/gh-social/blob/49073fc71423aa8e10334158d70ac6d41be1dbc0/src/app/onboarding/step2.tsx#L21-L31

Broad category IDs are stored as placeholder skills rather than canonical labels:

- https://github.com/ACM-VIT/gh-social/blob/49073fc71423aa8e10334158d70ac6d41be1dbc0/src/app/onboarding/step3.tsx#L35-L49

These defaults inject the same preferences into unrelated users.

## Proposed change

- Start technology selection empty unless the user explicitly accepts imported suggestions.
- Store canonical skill/interest names and stable taxonomy IDs separately.
- With explicit consent, import starred, owned, and contributed repositories plus aggregate language/topic signals.
- Index previously unseen public repositories discovered through a user's GitHub graph.
- Keep private-repository content excluded by default.
- Provide a diverse starter feed when GitHub data is unavailable.

## Acceptance criteria

- No technology is selected without user action or a clearly accepted import.
- ML onboarding receives canonical interests/skills rather than placeholder UI IDs.
- GitHub-derived preferences identify their source and timestamp.
- API-rate limiting, caching, pagination, consent, and account unlinking are documented and tested.
- Cold-start evaluation compares onboarding-only, GitHub-only, and combined profiles.

Start with backend/services/onboardingService.ts lines 80-135, then inspect src/app/onboarding/step2.tsx lines 21-31 and step3.tsx lines 35-49 to map the existing sync and selection flows. Done means accepted imports are consented, canonical and source-dated, private data stays excluded, unseen repositories and unavailable-data fallbacks work, and rate limiting, caching, pagination, unlinking, and cold-start comparisons are documented and tested.

Written by the indexing model from the issue text.