rename privacy "private" → "unlisted"; enable GPS for unlisted

- "unlisted" = not shown in the public feed, but GPS track, timeseries
  and detail JSON are all accessible by direct URL (security by obscurity)
- "private" accepted as legacy alias everywhere (backward compat with
  existing data on disk)
- New writes from Strava sync / ZIP upload / sidecar use "unlisted"
- Only "no_gps" now suppresses the GPS track
- isUnlisted() helper in format.ts used by all Svelte/Astro components
- SCHEMA.md and CLAUDE.md document the privacy model and the distinction
  between "unlisted" and "no_gps"

bincio/extract/timeseries.py

@@ -14,13 +14,14 @@ def build_timeseries(
 ) -> dict:
     """Return the BAS `timeseries` object.
 
-    privacy='no_gps' or 'private' → lat/lon set to null.
+    privacy='no_gps' → lat/lon set to null. All other privacy levels
+    (including 'unlisted') retain GPS in the timeseries.
     Downsamples so at most one point per second is emitted.
     """
     if not points:
         return {"t": []}
 
-    include_gps = privacy not in ("no_gps", "private")
+    include_gps = privacy not in ("no_gps", "private")  # "private" = legacy alias for "unlisted"
 
     # Downsample: keep at most one point per second
     sampled: list[DataPoint] = []