feat: scheduled Strava sync + admin suspend/delete account

- Add bincio sync-strava command: headless multi-user Strava sync
  designed for systemd timer. Discovers users via strava_token.json,
  skips users without their own strava_credentials.json, respects
  Strava visibility (only_me → unlisted). Treats 404 stream errors as
  no-GPS activities rather than retrying every run.
- Add deploy/systemd/bincio-sync.{service,timer}: runs every 3 hours,
  Persistent=true to catch up after downtime.
- Add POST /api/internal/rebuild: webhook for sync timer to trigger
  site rebuild, authenticated via X-Sync-Secret header.
- Add suspended column to users table with auto-migration on open_db.
  Suspended users are blocked at login and session lookup (covers both
  activity site and wiki, which share instance.db).
- Add POST /api/admin/users/{handle}/suspend|unsuspend and
  DELETE /api/admin/users/{handle}/account endpoints.
- Admin panel: Suspend/Unsuspend toggle, Del account button, suspended
  badge on user row.

deploy/systemd/bincio-sync.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=BincioActivity Strava sync
+Documentation=https://github.com/bincio/bincio-activity
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=root
+WorkingDirectory=/opt/bincio
+
+# Secrets: BINCIO_SYNC_SECRET (must match --sync-secret passed to bincio serve)
+# Copy /opt/bincio/deploy/systemd/sync.env.example → /etc/bincio/sync.env and fill it in.
+EnvironmentFile=/etc/bincio/sync.env
+
+ExecStart=/root/.local/bin/uv run --project /opt/bincio bincio sync-strava \
+    --data-dir /var/bincio/data \
+    --rebuild-url http://localhost:4041/api/internal/rebuild
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=bincio-sync
+
+# Don't restart on failure — the timer will retry in 3 hours.
+Restart=no

deploy/systemd/bincio-sync.timer

@@ -0,0 +1,14 @@
+[Unit]
+Description=BincioActivity Strava sync — every 3 hours
+Documentation=https://github.com/bincio/bincio-activity
+
+[Timer]
+# Fire at 00:00, 03:00, 06:00, 09:00, 12:00, 15:00, 18:00, 21:00 UTC
+OnCalendar=*-*-* 00,03,06,09,12,15,18,21:00:00
+# Catch up if the VPS was offline during a scheduled run
+Persistent=true
+# Spread load within a 2-minute window to avoid exact midnight spikes
+RandomizedDelaySec=120
+
+[Install]
+WantedBy=timers.target

deploy/systemd/sync.env.example

@@ -0,0 +1,7 @@
+# /etc/bincio/sync.env — secrets for bincio-sync.service
+# Copy this file to /etc/bincio/sync.env and fill in the values.
+# chmod 600 /etc/bincio/sync.env
+
+# Must match the --sync-secret / BINCIO_SYNC_SECRET value passed to `bincio serve`.
+# Generate with: openssl rand -hex 32
+BINCIO_SYNC_SECRET=your-secret-here