rename privacy "private" → "unlisted"; enable GPS for unlisted

- "unlisted" = not shown in the public feed, but GPS track, timeseries
  and detail JSON are all accessible by direct URL (security by obscurity)
- "private" accepted as legacy alias everywhere (backward compat with
  existing data on disk)
- New writes from Strava sync / ZIP upload / sidecar use "unlisted"
- Only "no_gps" now suppresses the GPS track
- isUnlisted() helper in format.ts used by all Svelte/Astro components
- SCHEMA.md and CLAUDE.md document the privacy model and the distinction
  between "unlisted" and "no_gps"

site/src/pages/activity/[id].astro

@@ -52,7 +52,7 @@ export async function getStaticPaths() {
     // Build the map from the index first
     const byId = new Map(
       activities
-        .filter(a => a.privacy !== 'private' && a.id)
+        .filter(a => a.privacy !== 'private' && a.privacy !== 'unlisted' && a.id)
         .map(a => [a.id, { activity: a, athlete }])
     );
 
@@ -80,7 +80,7 @@ export async function getStaticPaths() {
           if (byId.has(id)) continue;   // already covered by the index
           try {
             const detail = JSON.parse(readFileSync(join(actsDir, file), 'utf-8'));
-            if (detail.privacy === 'private') continue;
+            if (detail.privacy === 'private' || detail.privacy === 'unlisted') continue;
             // Build a minimal ActivitySummary from the detail file
             const a: ActivitySummary = {
               id,