rename privacy "private" → "unlisted"; enable GPS for unlisted

- "unlisted" = not shown in the public feed, but GPS track, timeseries
  and detail JSON are all accessible by direct URL (security by obscurity)
- "private" accepted as legacy alias everywhere (backward compat with
  existing data on disk)
- New writes from Strava sync / ZIP upload / sidecar use "unlisted"
- Only "no_gps" now suppresses the GPS track
- isUnlisted() helper in format.ts used by all Svelte/Astro components
- SCHEMA.md and CLAUDE.md document the privacy model and the distinction
  between "unlisted" and "no_gps"

site/src/components/AthleteView.svelte

@@ -4,6 +4,7 @@
   import MmpChart from './MmpChart.svelte';
   import RecordsView from './RecordsView.svelte';
   import AthleteDrawer from './AthleteDrawer.svelte';
+  import { isUnlisted } from '../lib/format';
   import { loadIndex, loadAthlete } from '../lib/dataloader';
 
   export let base: string = '/';
@@ -51,7 +52,7 @@
         } catch { /* ignore */ }
       }
       athlete = resolvedAthlete;
-      activities = index.activities.filter(a => a.mmp && a.privacy !== 'private');
+      activities = index.activities.filter(a => a.mmp && !isUnlisted(a.privacy));
     } catch (e: any) {
       error = e.message;
     } finally {