Add activity file downloads with per-activity download_disabled flag

New endpoint: GET /api/activity/{id}/download/{bas|original|gpx}
- bas: streams the BAS detail JSON as an attachment
- original: streams the original FIT or GPX file from originals/
- gpx: generates a GPX from the timeseries (always available when GPS exists)

download_disabled flag stored in sidecar (edits/{id}.md), propagated to
the merged BAS detail JSON. When set, only the owner can download.

Backend: ops.py writes flag to sidecar; merge.py propagates it to detail
JSON; download.py implements the endpoint; server.py registers the router.
Frontend: EditDrawer gets a "No download" toggle button; ActivityDetail
shows a Download section (hidden when disabled and viewer is not the owner).

bincio/serve/models.py

@@ -56,6 +56,7 @@ class ActivityEditRequest(BaseModel):
     private: bool | None = Field(default=None, description="Hide from public feed")
     highlight: bool | None = Field(default=None, description="Mark as favorite")
     gear: str | None = Field(default=None, description="Gear used")
+    download_disabled: bool | None = Field(default=None, description="Prevent others from downloading files")
 
 
 class ActivityEditResponse(BaseModel):