feat: scheduled Strava sync + admin suspend/delete account

- Add bincio sync-strava command: headless multi-user Strava sync
  designed for systemd timer. Discovers users via strava_token.json,
  skips users without their own strava_credentials.json, respects
  Strava visibility (only_me → unlisted). Treats 404 stream errors as
  no-GPS activities rather than retrying every run.
- Add deploy/systemd/bincio-sync.{service,timer}: runs every 3 hours,
  Persistent=true to catch up after downtime.
- Add POST /api/internal/rebuild: webhook for sync timer to trigger
  site rebuild, authenticated via X-Sync-Secret header.
- Add suspended column to users table with auto-migration on open_db.
  Suspended users are blocked at login and session lookup (covers both
  activity site and wiki, which share instance.db).
- Add POST /api/admin/users/{handle}/suspend|unsuspend and
  DELETE /api/admin/users/{handle}/account endpoints.
- Admin panel: Suspend/Unsuspend toggle, Del account button, suspended
  badge on user row.

deploy/systemd/sync.env.example

@@ -0,0 +1,7 @@
+# /etc/bincio/sync.env — secrets for bincio-sync.service
+# Copy this file to /etc/bincio/sync.env and fill in the values.
+# chmod 600 /etc/bincio/sync.env
+
+# Must match the --sync-secret / BINCIO_SYNC_SECRET value passed to `bincio serve`.
+# Generate with: openssl rand -hex 32
+BINCIO_SYNC_SECRET=your-secret-here