rename privacy "private" → "unlisted"; enable GPS for unlisted

- "unlisted" = not shown in the public feed, but GPS track, timeseries
  and detail JSON are all accessible by direct URL (security by obscurity)
- "private" accepted as legacy alias everywhere (backward compat with
  existing data on disk)
- New writes from Strava sync / ZIP upload / sidecar use "unlisted"
- Only "no_gps" now suppresses the GPS track
- isUnlisted() helper in format.ts used by all Svelte/Astro components
- SCHEMA.md and CLAUDE.md document the privacy model and the distinction
  between "unlisted" and "no_gps"

.claude/settings.local.json

@@ -0,0 +1,31 @@
+{
+  "permissions": {
+    "allow": [
+      "Read(//Users/brutsalvadi/src/bincio_data/_merged/**)",
+      "Read(//Users/brutsalvadi/src/bincio_data/**)",
+      "Bash(python3 -c \"import json,sys; d=json.load\\(sys.stdin\\); print\\(list\\(d.get\\(''''dependencies'''',{}\\).keys\\(\\)\\)\\)\")",
+      "Bash(uv run:*)",
+      "Bash(python3 -c \"import pyodide\")",
+      "Bash(uv build:*)",
+      "Bash(npm install:*)",
+      "Bash(npm run:*)",
+      "Bash(mkdir -p /tmp/bincio_ci/activities)",
+      "Bash(BINCIO_DATA_DIR=/tmp/bincio_ci npm run build)",
+      "Bash(ls /Users/brutsalvadi/src/bincio_activity/*.md)",
+      "Bash(python3:*)",
+      "Bash(wc -l /Users/brutsalvadi/src/bincio_activity/bincio/extract/*.py)",
+      "Bash(grep -E \"\\\\.py$\")",
+      "Bash([ -f ~/src/cycling_data_davide/activities.csv ])",
+      "Read(//Users/brutsalvadi/src/cycling_data_davide/**)",
+      "Bash(ls -la /tmp/bincio_dev_test/dave/_merged/activities/*.json)",
+      "Bash(ls -la /tmp/bincio_dev_test/dave/_merged/activities/*.geojson)",
+      "Bash(unzip -l ~/src/cycling_data_davide/export_18885842.zip)",
+      "Bash(unzip -p export_18885842.zip profile.csv)",
+      "Bash(unzip -p export_18885842.zip bikes.csv)",
+      "Bash(unzip -p export_18885842.zip routes.csv)",
+      "Bash(unzip -p export_18885842.zip privacy_zones.csv)",
+      "Bash(unzip -p export_18885842.zip activities.csv)",
+      "Bash(xargs -I{} python3 -c \"import json,sys; d=json.load\\(open\\('{}'\\)\\);print\\({k:d.get\\(k\\) for k in ['title','strava_id','started_at','privacy']}\\)\")"
+    ]
+  }
+}