Settings: per-user default for download_disabled

New pref download_disabled_default (stored in user_prefs + mirrored to
_user_settings.json for the render pipeline). When true, apply_sidecar
marks all activities as download_disabled unless the sidecar explicitly
sets download_disabled: false (per-activity opt-in from the edit drawer).

Settings page gets an "Activity defaults" card with the toggle.

site/src/pages/settings/index.astro

@@ -95,6 +95,18 @@ import Base from '../../layouts/Base.astro';
       <p id="nav-prefs-status" class="text-xs mt-3 hidden"></p>
     </section>
 
+    <!-- Activity defaults card -->
+    <section class="mb-6 rounded-xl bg-zinc-900 border border-zinc-800 p-5">
+      <h2 class="text-sm font-semibold text-zinc-400 uppercase tracking-wider mb-1">Activity defaults</h2>
+      <p class="text-xs text-zinc-600 mb-4">Applied to all activities that don't have an explicit per-activity override.</p>
+      <label class="flex items-center gap-3 cursor-pointer group">
+        <input id="pref-download-disabled" type="checkbox" class="accent-[--accent]" />
+        <span class="text-sm text-zinc-300 group-hover:text-white transition-colors">Disable downloads by default</span>
+      </label>
+      <p class="text-xs text-zinc-500 mt-2">When enabled, activity files cannot be downloaded by visitors. You can still override this per activity from the edit drawer.</p>
+      <p id="activity-defaults-status" class="text-xs mt-3 hidden"></p>
+    </section>
+
     <!-- Strava credentials card -->
     <section class="mb-6 rounded-xl bg-zinc-900 border border-zinc-800 p-5">
       <h2 class="text-sm font-semibold text-zinc-400 uppercase tracking-wider mb-1">Strava API credentials</h2>
@@ -456,6 +468,40 @@ import Base from '../../layouts/Base.astro';
     });
   }
 
+  // ── Activity defaults ─────────────────────────────────────────────────────────
+
+  const dlDefaultEl  = document.getElementById('pref-download-disabled') as HTMLInputElement;
+  const dlStatusEl   = document.getElementById('activity-defaults-status')!;
+
+  async function loadActivityDefaults() {
+    try {
+      const r = await fetch('/api/me/prefs', { credentials: 'include' });
+      if (!r.ok) return;
+      const prefs = await r.json();
+      dlDefaultEl.checked = prefs['download_disabled_default'] === 'true';
+    } catch {}
+  }
+
+  dlDefaultEl?.addEventListener('change', async () => {
+    try {
+      const r = await fetch('/api/me/prefs', {
+        method: 'PUT',
+        credentials: 'include',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ download_disabled_default: String(dlDefaultEl.checked) }),
+      });
+      if (r.ok) {
+        setStatus(dlStatusEl, 'Saved.', true);
+        setTimeout(() => dlStatusEl.classList.add('hidden'), 2000);
+      } else {
+        const d = await r.json();
+        setStatus(dlStatusEl, d.detail ?? 'Failed', false);
+      }
+    } catch {
+      setStatus(dlStatusEl, 'Could not reach server', false);
+    }
+  });
+
   // ── Strava credentials ────────────────────────────────────────────────────────
 
   async function loadStravaCreds() {
@@ -561,6 +607,7 @@ import Base from '../../layouts/Base.astro';
   loadMe();
   loadStorage();
   loadNavPrefs();
+  loadActivityDefaults();
   loadStravaCreds();
   loadStravaConnection();
 </script>