feat: Phase 0.5 — remote feed sync via Bearer token auth

Server (bincio/serve/server.py):
- Add _require_auth: accepts session cookie OR Authorization: Bearer token
- POST /api/auth/token: same as /api/auth/login but returns token in body
  (password used once, not stored; mobile stores only the session token)
- GET /api/feed: auth-gated; reads _merged/index.json for the user and
  returns the activities array as JSON

Mobile:
- db/sync.ts: syncFeed(db) fetches /api/feed, upserts each summary into
  local SQLite as origin='remote'; skips locally-imported activities
- db/queries.ts: add upsertRemoteActivity (INSERT ... ON CONFLICT DO UPDATE
  WHERE origin='remote' — never overwrites local imports); fix feed sort
  order to started_at DESC instead of insertion order
- settings.tsx: Connect section — password field (not persisted) + Connect
  button calls POST /api/auth/token and stores token; Disconnect clears it
- index.tsx: ↓ Sync button + pull-to-refresh both trigger syncFeed; cloud
  badge on remote activities; empty state updated

mobile/db/queries.ts

@@ -52,7 +52,7 @@ export function useActivities(): ActivitySummary[] {
       json_extract(detail_json, '$.duration_s')       AS duration_s,
       json_extract(detail_json, '$.elevation_gain_m') AS elevation_gain_m
     FROM activities
-    ORDER BY created_at DESC
+    ORDER BY json_extract(detail_json, '$.started_at') DESC
   `);
   return rows;
 }
@@ -85,6 +85,24 @@ export async function insertActivity(
   );
 }
 
+export async function upsertRemoteActivity(
+  db: ReturnType<typeof useSQLiteContext>,
+  id: string,
+  detailJson: string,
+): Promise<boolean> {
+  const now = Math.floor(Date.now() / 1000);
+  const result = await db.runAsync(
+    `INSERT INTO activities (id, source_hash, detail_json, origin, synced_at)
+     VALUES (?, ?, ?, 'remote', ?)
+     ON CONFLICT(id) DO UPDATE SET
+       detail_json = excluded.detail_json,
+       synced_at   = excluded.synced_at
+     WHERE origin = 'remote'`,
+    [id, id, detailJson, now],
+  );
+  return result.changes > 0;
+}
+
 // ── Settings ───────────────────────────────────────────────────────────────
 
 export async function getSetting(

mobile/db/sync.ts

@@ -0,0 +1,65 @@
+import type { SQLiteDatabase } from 'expo-sqlite';
+import { getSetting, upsertRemoteActivity } from './queries';
+
+export type SyncResult = { synced: number; error?: string };
+
+export async function syncFeed(db: SQLiteDatabase): Promise<SyncResult> {
+  const instanceUrl = (await getSetting(db, 'instance_url'))?.replace(/\/$/, '');
+  const token = await getSetting(db, 'api_token');
+
+  if (!instanceUrl || !token) {
+    return { synced: 0, error: 'No instance configured — add one in Settings.' };
+  }
+
+  let resp: Response;
+  try {
+    resp = await fetch(`${instanceUrl}/api/feed`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+  } catch {
+    return { synced: 0, error: 'Could not reach instance — check your connection.' };
+  }
+
+  if (resp.status === 401) {
+    return { synced: 0, error: 'Session expired — reconnect in Settings.' };
+  }
+  if (!resp.ok) {
+    return { synced: 0, error: `Server error (${resp.status})` };
+  }
+
+  const data: { activities?: RemoteSummary[] } = await resp.json();
+  const activities = data.activities ?? [];
+
+  let synced = 0;
+  for (const a of activities) {
+    const detailJson = JSON.stringify({
+      id: a.id,
+      title: a.title ?? a.id,
+      sport: a.sport ?? null,
+      started_at: a.started_at ?? null,
+      distance_m: a.distance_m ?? null,
+      moving_time_s: a.moving_time_s ?? null,
+      elevation_gain_m: a.elevation_gain_m ?? null,
+      avg_speed_kmh: a.avg_speed_kmh ?? null,
+      avg_hr_bpm: a.avg_hr_bpm ?? null,
+      avg_power_w: a.avg_power_w ?? null,
+    });
+    const changed = await upsertRemoteActivity(db, a.id, detailJson);
+    if (changed) synced++;
+  }
+
+  return { synced };
+}
+
+type RemoteSummary = {
+  id: string;
+  title?: string;
+  sport?: string;
+  started_at?: string;
+  distance_m?: number | null;
+  moving_time_s?: number | null;
+  elevation_gain_m?: number | null;
+  avg_speed_kmh?: number | null;
+  avg_hr_bpm?: number | null;
+  avg_power_w?: number | null;
+};