rename privacy "private" → "unlisted"; enable GPS for unlisted

- "unlisted" = not shown in the public feed, but GPS track, timeseries
  and detail JSON are all accessible by direct URL (security by obscurity)
- "private" accepted as legacy alias everywhere (backward compat with
  existing data on disk)
- New writes from Strava sync / ZIP upload / sidecar use "unlisted"
- Only "no_gps" now suppresses the GPS track
- isUnlisted() helper in format.ts used by all Svelte/Astro components
- SCHEMA.md and CLAUDE.md document the privacy model and the distinction
  between "unlisted" and "no_gps"

site/src/layouts/Base.astro

@@ -368,8 +368,8 @@ try {
           </div>
           <label class="flex items-center gap-2 mt-3 text-xs text-zinc-400 cursor-pointer select-none">
             <input id="zip-private" type="checkbox" class="accent-blue-500" />
-            Mark all imported activities as private
-            <span class="text-zinc-600">(Strava export doesn't include privacy settings)</span>
+            Mark all imported activities as unlisted
+            <span class="text-zinc-600">(not shown in feed; GPS track still accessible by URL)</span>
           </label>
           <p id="zip-status" class="mt-3 text-xs text-center leading-relaxed" style="min-height: 1.25rem"></p>
         </div>