rename privacy "private" → "unlisted"; enable GPS for unlisted

- "unlisted" = not shown in the public feed, but GPS track, timeseries
  and detail JSON are all accessible by direct URL (security by obscurity)
- "private" accepted as legacy alias everywhere (backward compat with
  existing data on disk)
- New writes from Strava sync / ZIP upload / sidecar use "unlisted"
- Only "no_gps" now suppresses the GPS track
- isUnlisted() helper in format.ts used by all Svelte/Astro components
- SCHEMA.md and CLAUDE.md document the privacy model and the distinction
  between "unlisted" and "no_gps"

bincio/extract/strava_api.py

@@ -201,7 +201,7 @@ def strava_to_parsed(meta: dict, streams: dict) -> ParsedActivity:
     source = f"strava:{meta['id']}"
     source_hash = "sha256:" + hashlib.sha256(source.encode()).hexdigest()
 
-    # Map Strava visibility to BAS privacy: only_me → private, everything else → public
+    # Map Strava visibility to BAS privacy: only_me → unlisted, everything else → public
     visibility = meta.get("visibility") or ""
     is_private = meta.get("private", False) or visibility == "only_me"
 
@@ -214,5 +214,5 @@ def strava_to_parsed(meta: dict, streams: dict) -> ParsedActivity:
         title=meta.get("name") or None,
         description=meta.get("description") or None,
         strava_id=str(meta["id"]),
-        privacy="private" if is_private else "public",
+        privacy="unlisted" if is_private else "public",
     )

bincio/extract/timeseries.py

@@ -14,13 +14,14 @@ def build_timeseries(
 ) -> dict:
     """Return the BAS `timeseries` object.
 
-    privacy='no_gps' or 'private' → lat/lon set to null.
+    privacy='no_gps' → lat/lon set to null. All other privacy levels
+    (including 'unlisted') retain GPS in the timeseries.
     Downsamples so at most one point per second is emitted.
     """
     if not points:
         return {"t": []}
 
-    include_gps = privacy not in ("no_gps", "private")
+    include_gps = privacy not in ("no_gps", "private")  # "private" = legacy alias for "unlisted"
 
     # Downsample: keep at most one point per second
     sampled: list[DataPoint] = []

bincio/extract/writer.py

@@ -48,7 +48,10 @@ def write_activity(
     acts_dir.mkdir(parents=True, exist_ok=True)
 
     source = _infer_source(activity)
-    has_gps = metrics.bbox is not None and privacy not in ("no_gps", "private")
+    # "unlisted" activities keep their GPS track (not in the public feed, but the
+    # URL is not secret — same model as the detail JSON). Only "no_gps" suppresses
+    # the track. "private" is the legacy alias for "unlisted".
+    has_gps = metrics.bbox is not None and privacy not in ("no_gps",)
 
     # Build timeseries once — written to a separate file to keep detail JSON small.
     # Treat an empty timeseries (no points) as None so no file is created.
@@ -220,7 +223,7 @@ def build_summary(
     privacy: str = "public",
 ) -> dict:
     """Build the Activity Summary object for index.json."""
-    has_gps = metrics.bbox is not None and privacy not in ("no_gps", "private")
+    has_gps = metrics.bbox is not None and privacy not in ("no_gps",)
     return {
         "id": activity_id,
         "title": activity.title or _auto_title(activity),