Add activity file downloads with per-activity download_disabled flag

New endpoint: GET /api/activity/{id}/download/{bas|original|gpx}
- bas: streams the BAS detail JSON as an attachment
- original: streams the original FIT or GPX file from originals/
- gpx: generates a GPX from the timeseries (always available when GPS exists)

download_disabled flag stored in sidecar (edits/{id}.md), propagated to
the merged BAS detail JSON. When set, only the owner can download.

Backend: ops.py writes flag to sidecar; merge.py propagates it to detail
JSON; download.py implements the endpoint; server.py registers the router.
Frontend: EditDrawer gets a "No download" toggle button; ActivityDetail
shows a Download section (hidden when disabled and viewer is not the owner).

bincio/serve/server.py

@@ -20,6 +20,7 @@ from bincio.serve.routers import (
     activities,
     admin,
     auth,
+    download,
     feed,
     garmin,
     ideas,
@@ -60,6 +61,7 @@ for _router in [
     me.router,
     admin.router,
     activities.router,
+    download.router,
     uploads.router,
     segments.router,
     strava.router,