rename privacy "private" → "unlisted"; enable GPS for unlisted

- "unlisted" = not shown in the public feed, but GPS track, timeseries
  and detail JSON are all accessible by direct URL (security by obscurity)
- "private" accepted as legacy alias everywhere (backward compat with
  existing data on disk)
- New writes from Strava sync / ZIP upload / sidecar use "unlisted"
- Only "no_gps" now suppresses the GPS track
- isUnlisted() helper in format.ts used by all Svelte/Astro components
- SCHEMA.md and CLAUDE.md document the privacy model and the distinction
  between "unlisted" and "no_gps"

bincio/extract/writer.py

@@ -48,7 +48,10 @@ def write_activity(
     acts_dir.mkdir(parents=True, exist_ok=True)
 
     source = _infer_source(activity)
-    has_gps = metrics.bbox is not None and privacy not in ("no_gps", "private")
+    # "unlisted" activities keep their GPS track (not in the public feed, but the
+    # URL is not secret — same model as the detail JSON). Only "no_gps" suppresses
+    # the track. "private" is the legacy alias for "unlisted".
+    has_gps = metrics.bbox is not None and privacy not in ("no_gps",)
 
     # Build timeseries once — written to a separate file to keep detail JSON small.
     # Treat an empty timeseries (no points) as None so no file is created.
@@ -220,7 +223,7 @@ def build_summary(
     privacy: str = "public",
 ) -> dict:
     """Build the Activity Summary object for index.json."""
-    has_gps = metrics.bbox is not None and privacy not in ("no_gps", "private")
+    has_gps = metrics.bbox is not None and privacy not in ("no_gps",)
     return {
         "id": activity_id,
         "title": activity.title or _auto_title(activity),