v0.2.0

Added

• Ride activity tools: bosch_get_activities (per-ride summaries - distance, elevation, avg/max speed, cadence, measured rider power, calories, rider-vs-motor energy share, assist-mode split, CO2, ABS/brake events) and bosch_get_activity_detail (per-point GPS/speed/elevation/cadence/power track). Live reads from the rider-activity API with the standard one-bike-app sign-in - no EU Data Act registration needed.
• Unofficial / not-affiliated / read-only disclaimer in the README and auth flow.

Changed

• Sync is routed by the active token's client (EUDA client -> Data Act API, standard sign-in -> mobile app API) instead of trying both.
• Components and current firmware are read from the mobile bike profile under a standard sign-in, so non-EU accounts get component data without an EU Data Act registration.
• Sync results report a per-type status (ok / empty / unavailable / error) with a machine code and human message instead of a silent 0 records.

Fixed

• A euda token on a non-EU account no longer caches silently as zero; it reports empty / euda_empty with the remedy.
• Data-Act-only types report unavailable under a standard sign-in and skip the doomed request.
• Components with no serial number no longer accumulate duplicate rows each sync.
• 403 Forbidden now raises BoschForbiddenError with a client-aware hint instead of being swallowed.