rename privacy "private" → "unlisted"; enable GPS for unlisted

- "unlisted" = not shown in the public feed, but GPS track, timeseries
  and detail JSON are all accessible by direct URL (security by obscurity)
- "private" accepted as legacy alias everywhere (backward compat with
  existing data on disk)
- New writes from Strava sync / ZIP upload / sidecar use "unlisted"
- Only "no_gps" now suppresses the GPS track
- isUnlisted() helper in format.ts used by all Svelte/Astro components
- SCHEMA.md and CLAUDE.md document the privacy model and the distinction
  between "unlisted" and "no_gps"

bincio/serve/server.py

@@ -879,7 +879,7 @@ async def upload_strava_zip(
     if not file.filename or not file.filename.lower().endswith(".zip"):
         raise HTTPException(400, "Please upload a .zip file")
 
-    privacy = "private" if private.lower() in ("true", "1", "yes") else "public"
+    privacy = "unlisted" if private.lower() in ("true", "1", "yes") else "public"
 
     dd = _get_data_dir() / user.handle
     import tempfile