Add activity file downloads with per-activity download_disabled flag

New endpoint: GET /api/activity/{id}/download/{bas|original|gpx}
- bas: streams the BAS detail JSON as an attachment
- original: streams the original FIT or GPX file from originals/
- gpx: generates a GPX from the timeseries (always available when GPS exists)

download_disabled flag stored in sidecar (edits/{id}.md), propagated to
the merged BAS detail JSON. When set, only the owner can download.

Backend: ops.py writes flag to sidecar; merge.py propagates it to detail
JSON; download.py implements the endpoint; server.py registers the router.
Frontend: EditDrawer gets a "No download" toggle button; ActivityDetail
shows a Download section (hidden when disabled and viewer is not the owner).

site/src/lib/types.ts

@@ -124,6 +124,8 @@ export interface ActivityDetail extends Omit<ActivitySummary, 'detail_url' | 'tr
   mmp: MmpCurve | null;
   strava_id: string | null;
   duplicate_of: string | null;
+  source_file?: string | null;
+  download_disabled?: boolean;
   custom: Record<string, unknown>;
 }