rename privacy "private" → "unlisted"; enable GPS for unlisted

- "unlisted" = not shown in the public feed, but GPS track, timeseries
  and detail JSON are all accessible by direct URL (security by obscurity)
- "private" accepted as legacy alias everywhere (backward compat with
  existing data on disk)
- New writes from Strava sync / ZIP upload / sidecar use "unlisted"
- Only "no_gps" now suppresses the GPS track
- isUnlisted() helper in format.ts used by all Svelte/Astro components
- SCHEMA.md and CLAUDE.md document the privacy model and the distinction
  between "unlisted" and "no_gps"

bincio/extract/strava_api.py

@@ -201,7 +201,7 @@ def strava_to_parsed(meta: dict, streams: dict) -> ParsedActivity:
     source = f"strava:{meta['id']}"
     source_hash = "sha256:" + hashlib.sha256(source.encode()).hexdigest()
 
-    # Map Strava visibility to BAS privacy: only_me → private, everything else → public
+    # Map Strava visibility to BAS privacy: only_me → unlisted, everything else → public
     visibility = meta.get("visibility") or ""
     is_private = meta.get("private", False) or visibility == "only_me"
 
@@ -214,5 +214,5 @@ def strava_to_parsed(meta: dict, streams: dict) -> ParsedActivity:
         title=meta.get("name") or None,
         description=meta.get("description") or None,
         strava_id=str(meta["id"]),
-        privacy="private" if is_private else "public",
+        privacy="unlisted" if is_private else "public",
     )