[Security] Require authentication and ownership checks on activity and repository mutations

## Problem

Most activity routes are currently unauthenticated and trust user IDs supplied in the URL, including reading all activity, reading another user's activity, creating, updating, deleting, liking, and saving:

- https://github.com/ACM-VIT/gh-social/blob/49073fc71423aa8e10334158d70ac6d41be1dbc0/backend/routes/activityRoutes.ts#L23-L57

Repository import, view mutation, and synchronization routes are also publicly callable:

- https://github.com/ACM-VIT/gh-social/blob/49073fc71423aa8e10334158d70ac6d41be1dbc0/backend/routes/repoRoutes.ts#L15-L31

PR #51 adds authentication to the like/save toggles, but the remaining activity CRUD and repository mutations still need an explicit authorization policy.

## Proposed change

- Require authentication on every non-public activity endpoint.
- Derive the acting user from the token instead of trusting `:userId`.
- Enforce self/admin authorization for activity reads and writes.
- Require authentication, validation, rate limits, and an ownership/admin policy for repository import/sync.
- Review board/private-data routes for viewer IDs supplied through query parameters.
- Add request-size and abuse protections to GitHub-triggering endpoints.

## Acceptance criteria

- Cross-user activity access returns 403 unless an explicit admin policy permits it.
- Anonymous activity mutations and repo import/sync requests return 401.
- User-controlled path/query fields cannot impersonate the authenticated identity.
- Security tests cover IDOR attempts for activity, saves, likes, private boards, repo import, and sync.
- Public endpoints and their intended data exposure are documented.

Start with backend/routes/activityRoutes.ts (L23-L57) and backend/routes/repoRoutes.ts (L15-L31), then review PR #51's authentication changes. Map every activity and repository mutation, along with board/private-data routes, to the stated authentication and ownership policies. Done means anonymous requests return 401, unauthorized cross-user access returns 403, impersonation is prevented, abuse protections are applied, and the listed IDOR security tests and public-endpoint documentation exist.

Written by the indexing model from the issue text.