fix: GitHub token stored in client-side localStorage for API calls — tok... (JhaSourav07#2022)

## Description

Fixes JhaSourav07#2017 — GitHub token stored in client-side localStorage for API
calls — token can be exfiltrated via XSS. Add server-only import guard
to ensure GITHUB_PAT / GITHUB_TOKEN are never bundled into browser
JavaScript.

## Pillar

- [ ] 🎨 Pillar 1 — New Theme Design
- [ ] 📐 Pillar 2 — Geometric SVG Improvement
- [ ] 🕐 Pillar 3 — Timezone Logic Optimization
- [x] 🛠️ Other (Bug fix, refactoring, docs)

## Visual Preview

_This is a logic/security fix — no visual changes expected._

## Checklist before requesting a review:

- [ ] I have read the `CONTRIBUTING.md` file.
- [ ] I have tested these changes locally.
- [ ] I have run `npm run format` and `npm run lint` locally and
resolved all errors.
- [ ] I have run `npm run test` and all tests pass locally.
- [ ] I have run `npm run test:coverage` and branch coverage is at or
above 70%.
- [ ] My commits follow the Conventional Commits format.
- [ ] I have started the repo.
- [ ] I have made sure that i have only one commit to merge in this PR.
- [ ] The SVG output matches the CommitPulse "premium quality" aesthetic
standard.

## Related Issue
Closes JhaSourav07#2017

Author: JhaSourav07

lib/github.test.ts

@@ -24,6 +24,8 @@ import {
 } from './github';
 import type { ContributionCalendar } from '../types';
 
+vi.mock('server-only', () => ({}));
+
 const mockCalendar: ContributionCalendar = {
   totalContributions: 42,
   weeks: [

lib/github.ts

@@ -12,6 +12,8 @@ import { DistributedCache } from '@/lib/cache';
 import { LANGUAGE_COLORS } from '@/lib/svg/languageColors';
 import { CONTRIBUTION_MILESTONES, STREAK_MILESTONES } from './svg/constants';
 
+import 'server-only';
+
 interface GitHubRepo {
   name: string;
   stargazers_count: number;

package-lock.json

@@ -42,6 +42,7 @@
     "react-force-graph-2d": "^1.29.1",
     "react-hot-toast": "^2.6.0",
     "react-icons": "^5.6.0",
+    "server-only": "^0.0.1",
     "sonner": "^2.0.7",
     "zod": "^4.4.3"
   },