rename privacy "private" → "unlisted"; enable GPS for unlisted

- "unlisted" = not shown in the public feed, but GPS track, timeseries
  and detail JSON are all accessible by direct URL (security by obscurity)
- "private" accepted as legacy alias everywhere (backward compat with
  existing data on disk)
- New writes from Strava sync / ZIP upload / sidecar use "unlisted"
- Only "no_gps" now suppresses the GPS track
- isUnlisted() helper in format.ts used by all Svelte/Astro components
- SCHEMA.md and CLAUDE.md document the privacy model and the distinction
  between "unlisted" and "no_gps"

site/src/components/StatsView.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
   import { onMount } from 'svelte';
   import type { ActivitySummary, BASIndex, Sport } from '../lib/types';
-  import { formatDistance, formatDuration, sportIcon, sportColor, sportLabel } from '../lib/format';
+  import { formatDistance, formatDuration, isUnlisted, sportIcon, sportColor, sportLabel } from '../lib/format';
   import { loadIndex } from '../lib/dataloader';
 
   /** Explicit index URL — use for per-user stats pages in multi-user mode. */
@@ -35,7 +35,7 @@
     mounted = true;
     try {
       const index = await loadIndex(import.meta.env.BASE_URL, indexUrl || undefined);
-      all = index.activities.filter(a => a.privacy !== 'private' && a.distance_m);
+      all = index.activities.filter(a => !isUnlisted(a.privacy) && a.distance_m);
     } catch (e: any) {
       error = e.message;
     }