Add public contributor leaderboard

[saurabhhhcodes]

Summary

• add a public /leaderboard page with tabs for current streak, monthly commits, and monthly PRs
• add /api/leaderboard with hourly server-side caching, lightweight IP rate limiting, and GitHub-backed metric aggregation for opted-in public users
• add an explicit leaderboard_opt_in setting plus Supabase migration so leaderboard visibility is separate from simply having a public profile
• update settings so enabling leaderboard visibility also enables the public profile link used by leaderboard rows

Closes #259

Testing

• /Users/saurabhkumarbajpaiai/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin/node node_modules/typescript/bin/tsc --noEmit ✅
• /Users/saurabhkumarbajpaiai/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin/node node_modules/next/dist/bin/next lint ✅ warnings only from pre-existing BadgeSection <img> usage and CommitTimeChart hook dependency
• git diff --check ✅
• /Users/saurabhkumarbajpaiai/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin/node node_modules/next/dist/bin/next build ✅ compiled successfully, then stopped during page data collection because local NEXT_PUBLIC_SUPABASE_URL / Supabase env is not configured (supabaseUrl is required)

GSSoC labels

Could you please add gssoc:approved, level:advanced, and type:feature if this matches the issue scope?

[vercel]

@saurabhhhcodes is attempting to deploy a commit to the PRIYANSHU DOSHI's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Priyanshu-byte-coder]

Strong feature overall — double opt-in design, auto-enable public profile, server-rendered page, good caching, clean CSS vars throughout. Two fixes needed before merge:

1. Hardcoded bg-white on toggle thumb (settings/page.tsx):

// Replace:
className={`absolute left-1 top-1 h-4 w-4 rounded-full bg-white transition-transform ...`}
// With:
className={`absolute left-1 top-1 h-4 w-4 rounded-full bg-[var(--card)] transition-transform ...`}

2. Rate limit key uses x-forwarded-for as primary (leaderboard/route.ts) — spoofable. Use req.ip first:

function getRateLimitKey(req: NextRequest): string {
  return (
    req.ip ??
    req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
    req.headers.get("x-real-ip") ??
    "unknown"
  );
}

Fix these two and push — everything else is solid, will merge.