Prepare GitVisual public launch

[beme08]

What changed

• adds GitHub App user authentication with PKCE and expiring token refresh
• loads public starred repositories without requesting GitHub Starring permission
• isolates cached star data and refresh throttling by signed user session
• adds security headers, health checks, production smoke coverage, CI, and Docker support
• polishes the responsive treemap UI with clear demo/live states and empty/error handling
• documents local setup, configuration, security expectations, and contributions

Why

This prepares GitVisual for a safe public open-source launch while keeping the GitHub App permission scope minimal and making the experience presentable for first-time users.

Impact

Signed-in users can visualize their own public starred repositories. Visitors can explore demo data before authenticating. Contributors have a documented setup and verification path.

Checks

• npm run check
• 8 Node tests passed
• Astro production build passed
• production health, headers, auth redirect, and unauthenticated API smoke checks passed
• tracked/build artifact credential scans passed