rename privacy "private" → "unlisted"; enable GPS for unlisted

- "unlisted" = not shown in the public feed, but GPS track, timeseries
  and detail JSON are all accessible by direct URL (security by obscurity)
- "private" accepted as legacy alias everywhere (backward compat with
  existing data on disk)
- New writes from Strava sync / ZIP upload / sidecar use "unlisted"
- Only "no_gps" now suppresses the GPS track
- isUnlisted() helper in format.ts used by all Svelte/Astro components
- SCHEMA.md and CLAUDE.md document the privacy model and the distinction
  between "unlisted" and "no_gps"

site/src/components/ActivityDetailLoader.svelte

@@ -2,6 +2,7 @@
   import { onMount } from 'svelte';
   import { loadIndex } from '../lib/dataloader';
   import ActivityDetail from './ActivityDetail.svelte';
+  import { isUnlisted } from '../lib/format';
   import type { ActivitySummary, BASIndex } from '../lib/types';
 
   export let base: string = '/';
@@ -48,7 +49,7 @@
             source: d.source ?? null,
             privacy: d.privacy ?? 'public',
             detail_url: `${shard.handle}/_merged/activities/${id}.json`,
-            track_url: d.bbox && d.privacy !== 'private' && d.privacy !== 'no_gps'
+            track_url: d.bbox && d.privacy !== 'no_gps'
               ? `${shard.handle}/_merged/activities/${id}.geojson`
               : null,
             preview_coords: null,