rename privacy "private" → "unlisted"; enable GPS for unlisted

- "unlisted" = not shown in the public feed, but GPS track, timeseries
  and detail JSON are all accessible by direct URL (security by obscurity)
- "private" accepted as legacy alias everywhere (backward compat with
  existing data on disk)
- New writes from Strava sync / ZIP upload / sidecar use "unlisted"
- Only "no_gps" now suppresses the GPS track
- isUnlisted() helper in format.ts used by all Svelte/Astro components
- SCHEMA.md and CLAUDE.md document the privacy model and the distinction
  between "unlisted" and "no_gps"

site/src/components/ActivityDetailLoader.svelte

@@ -2,6 +2,7 @@
   import { onMount } from 'svelte';
   import { loadIndex } from '../lib/dataloader';
   import ActivityDetail from './ActivityDetail.svelte';
+  import { isUnlisted } from '../lib/format';
   import type { ActivitySummary, BASIndex } from '../lib/types';
 
   export let base: string = '/';
@@ -48,7 +49,7 @@
             source: d.source ?? null,
             privacy: d.privacy ?? 'public',
             detail_url: `${shard.handle}/_merged/activities/${id}.json`,
-            track_url: d.bbox && d.privacy !== 'private' && d.privacy !== 'no_gps'
+            track_url: d.bbox && d.privacy !== 'no_gps'
               ? `${shard.handle}/_merged/activities/${id}.geojson`
               : null,
             preview_coords: null,

site/src/components/ActivityFeed.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
   import { onMount } from 'svelte';
   import type { ActivitySummary, BASIndex, Sport } from '../lib/types';
-  import { formatDistance, formatDuration, formatElevation, formatDate, sportIcon, sportColor, sportLabel } from '../lib/format';
+  import { formatDistance, formatDuration, formatElevation, formatDate, isUnlisted, sportIcon, sportColor, sportLabel } from '../lib/format';
   import { loadIndex } from '../lib/dataloader';
 
   /** Render preview_coords as an SVG polyline path string. */
@@ -47,11 +47,11 @@
   let me: string = '';
 
   // Show private activities only to their owner.
-  // On a profile page (filterHandle set): show private if me === filterHandle.
-  // On the global feed: show private only for the logged-in user's own activities.
+  // On a profile page (filterHandle set): show unlisted if me === filterHandle.
+  // On the global feed: show unlisted only for the logged-in user's own activities.
   $: isOwner = filterHandle !== '' && me === filterHandle;
   $: withPrivacy = all.filter(a => {
-    if (a.privacy === 'private') {
+    if (isUnlisted(a.privacy)) {
       return filterHandle ? isOwner : (me !== '' && (a as any).handle === me);
     }
     return true;
@@ -161,8 +161,8 @@
             </p>
             <!-- stretched link covers the whole card; sits below the handle link -->
             <h3 class="font-semibold text-white truncate group-hover:text-[--accent] transition-colors flex items-center gap-1.5">
-              {#if a.privacy === 'private'}
-                <span class="text-zinc-500 shrink-0" title="Private">🔒</span>
+              {#if isUnlisted(a.privacy)}
+                <span class="text-zinc-500 shrink-0" title="Unlisted">🔒</span>
               {/if}
               <a
                 href={a.detail_url ? `${import.meta.env.BASE_URL}activity/${a.id}/` : `${import.meta.env.BASE_URL}activity/local/?id=${a.id}`}

site/src/components/AthleteView.svelte

@@ -4,6 +4,7 @@
   import MmpChart from './MmpChart.svelte';
   import RecordsView from './RecordsView.svelte';
   import AthleteDrawer from './AthleteDrawer.svelte';
+  import { isUnlisted } from '../lib/format';
   import { loadIndex, loadAthlete } from '../lib/dataloader';
 
   export let base: string = '/';
@@ -51,7 +52,7 @@
         } catch { /* ignore */ }
       }
       athlete = resolvedAthlete;
-      activities = index.activities.filter(a => a.mmp && a.privacy !== 'private');
+      activities = index.activities.filter(a => a.mmp && !isUnlisted(a.privacy));
     } catch (e: any) {
       error = e.message;
     } finally {

site/src/components/CommunityView.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
   import { onMount } from 'svelte';
   import type { BASIndex, ActivitySummary } from '../lib/types';
-  import { formatDistance, formatDuration, sportIcon } from '../lib/format';
+  import { formatDistance, formatDuration, isUnlisted, sportIcon } from '../lib/format';
 
   export let base: string = '/';
 
@@ -74,7 +74,7 @@
     const tot: Totals = { count: 0, distance_m: 0, elevation_m: 0, duration_s: 0, users: 0 };
 
     for (const u of rawUsers) {
-      const pub = u.activities.filter(a => a.privacy !== 'private');
+      const pub = u.activities.filter(a => !isUnlisted(a.privacy));
       const filtered = pub.filter(a => new Date(a.started_at) >= start);
 
       const stat: UserStat = {

site/src/components/StatsView.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
   import { onMount } from 'svelte';
   import type { ActivitySummary, BASIndex, Sport } from '../lib/types';
-  import { formatDistance, formatDuration, sportIcon, sportColor, sportLabel } from '../lib/format';
+  import { formatDistance, formatDuration, isUnlisted, sportIcon, sportColor, sportLabel } from '../lib/format';
   import { loadIndex } from '../lib/dataloader';
 
   /** Explicit index URL — use for per-user stats pages in multi-user mode. */
@@ -35,7 +35,7 @@
     mounted = true;
     try {
       const index = await loadIndex(import.meta.env.BASE_URL, indexUrl || undefined);
-      all = index.activities.filter(a => a.privacy !== 'private' && a.distance_m);
+      all = index.activities.filter(a => !isUnlisted(a.privacy) && a.distance_m);
     } catch (e: any) {
       error = e.message;
     }