feat: Phase 0.5 — remote feed sync via Bearer token auth

Server (bincio/serve/server.py):
- Add _require_auth: accepts session cookie OR Authorization: Bearer token
- POST /api/auth/token: same as /api/auth/login but returns token in body
  (password used once, not stored; mobile stores only the session token)
- GET /api/feed: auth-gated; reads _merged/index.json for the user and
  returns the activities array as JSON

Mobile:
- db/sync.ts: syncFeed(db) fetches /api/feed, upserts each summary into
  local SQLite as origin='remote'; skips locally-imported activities
- db/queries.ts: add upsertRemoteActivity (INSERT ... ON CONFLICT DO UPDATE
  WHERE origin='remote' — never overwrites local imports); fix feed sort
  order to started_at DESC instead of insertion order
- settings.tsx: Connect section — password field (not persisted) + Connect
  button calls POST /api/auth/token and stores token; Disconnect clears it
- index.tsx: ↓ Sync button + pull-to-refresh both trigger syncFeed; cloud
  badge on remote activities; empty state updated

mobile/db/sync.ts

@@ -0,0 +1,65 @@
+import type { SQLiteDatabase } from 'expo-sqlite';
+import { getSetting, upsertRemoteActivity } from './queries';
+
+export type SyncResult = { synced: number; error?: string };
+
+export async function syncFeed(db: SQLiteDatabase): Promise<SyncResult> {
+  const instanceUrl = (await getSetting(db, 'instance_url'))?.replace(/\/$/, '');
+  const token = await getSetting(db, 'api_token');
+
+  if (!instanceUrl || !token) {
+    return { synced: 0, error: 'No instance configured — add one in Settings.' };
+  }
+
+  let resp: Response;
+  try {
+    resp = await fetch(`${instanceUrl}/api/feed`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+  } catch {
+    return { synced: 0, error: 'Could not reach instance — check your connection.' };
+  }
+
+  if (resp.status === 401) {
+    return { synced: 0, error: 'Session expired — reconnect in Settings.' };
+  }
+  if (!resp.ok) {
+    return { synced: 0, error: `Server error (${resp.status})` };
+  }
+
+  const data: { activities?: RemoteSummary[] } = await resp.json();
+  const activities = data.activities ?? [];
+
+  let synced = 0;
+  for (const a of activities) {
+    const detailJson = JSON.stringify({
+      id: a.id,
+      title: a.title ?? a.id,
+      sport: a.sport ?? null,
+      started_at: a.started_at ?? null,
+      distance_m: a.distance_m ?? null,
+      moving_time_s: a.moving_time_s ?? null,
+      elevation_gain_m: a.elevation_gain_m ?? null,
+      avg_speed_kmh: a.avg_speed_kmh ?? null,
+      avg_hr_bpm: a.avg_hr_bpm ?? null,
+      avg_power_w: a.avg_power_w ?? null,
+    });
+    const changed = await upsertRemoteActivity(db, a.id, detailJson);
+    if (changed) synced++;
+  }
+
+  return { synced };
+}
+
+type RemoteSummary = {
+  id: string;
+  title?: string;
+  sport?: string;
+  started_at?: string;
+  distance_m?: number | null;
+  moving_time_s?: number | null;
+  elevation_gain_m?: number | null;
+  avg_speed_kmh?: number | null;
+  avg_hr_bpm?: number | null;
+  avg_power_w?: number | null;
+};