rename privacy "private" → "unlisted"; enable GPS for unlisted

- "unlisted" = not shown in the public feed, but GPS track, timeseries
  and detail JSON are all accessible by direct URL (security by obscurity)
- "private" accepted as legacy alias everywhere (backward compat with
  existing data on disk)
- New writes from Strava sync / ZIP upload / sidecar use "unlisted"
- Only "no_gps" now suppresses the GPS track
- isUnlisted() helper in format.ts used by all Svelte/Astro components
- SCHEMA.md and CLAUDE.md document the privacy model and the distinction
  between "unlisted" and "no_gps"

CLAUDE.md

@@ -205,6 +205,11 @@ gear: "Trek Domane"
 Rode with friends. Legs felt great after the rest week...
 ```
 
+The sidecar `private: true` flag maps to `privacy: "unlisted"` in the merged JSON.
+**`unlisted`** means: not shown in the public feed, but the activity detail, GPS track,
+and timeseries are all accessible by direct URL (security by obscurity, same model
+as the detail JSON itself). Use `no_gps` if the GPS track must not be published.
+
 ### Editing UX: drawer in Astro + `bincio edit` write API
 
 - `bincio edit --data-dir ~/bincio_data` starts a FastAPI server on port 4041