feat: onboarding data sync with OAuth persistence

[johnshift]

Summary

• Add BFF API routes for onboarding sync (/api/onboarding/sync), profile skills/showcase management, and resume download
• Implement end-to-end onboarding flow: resume parsing → skill selection → OAuth login → data sync to middleware → redirect to profile
• Persist onboarding Zustand store to sessionStorage so data survives OAuth redirect (full page reload)
• Skip unconditional reset() on OAuth return to prevent wiping rehydrated state
• Add suggested skills fetching from API using MW UUIDs for skill IDs
• Add profile page debug sections for skills and showcases
• Extract shared getTagColorIndex utility used by job list DTO and onboarding skills

Test plan

• Start fresh onboarding → upload resume → select skills → click "Continue with Google" → verify data syncs after OAuth redirect
• Verify /api/onboarding/sync receives correct payload (parsed resume + selected skills) in Network tab
• Verify profile page shows synced skills and showcases after redirect
• Fresh visit to /onboarding starts clean (no stale data from previous session)
• Verify sessionStorage key onboarding-store is cleared after redirect to /profile
• Email/wallet login (no redirect) still works — in-memory store remains intact
• pnpm build passes with no type errors
• All 97 existing tests pass