fix(version): move the finer geo state to the admin status

geoLookup and geoProviderChosen on the public /api/version added one
more way to tell instances apart. They now live on /api/admin/status
(requireAdmin, cookie only) as geo { lookup, providerChosen,
providerHost }, which both admin status views read. offlineGeoEnabled
and geoProviderHost stay public as before.

src/app/api/admin/status/__tests__/route.test.ts

@@ -44,6 +44,17 @@ vi.mock("@/lib/jobs/worker-status", () => ({
   })),
 }));
 
+const geoMock = vi.hoisted(() => ({
+  lookup: "online" as "offline" | "online" | "off",
+  chosen: false,
+  host: "ipwho.is",
+}));
+vi.mock("@/lib/geo", () => ({
+  geoLookupMode: () => geoMock.lookup,
+  geoProviderChosen: () => geoMock.chosen,
+  resolveGeoProviderHost: () => geoMock.host,
+}));
+
 vi.mock("@/lib/jobs/job-failures", () => ({
   JOB_FAILURE_WINDOW_HOURS: 72,
   readFailingQueues: vi.fn(),
@@ -208,4 +219,17 @@ describe("GET /api/admin/status (integration health summary)", () => {
       ],
     });
   });
+
+  it("carries the login-IP geo state the public version route no longer shows", async () => {
+    geoMock.lookup = "online";
+    geoMock.chosen = true;
+    geoMock.host = "ip-api.com";
+    const res = await GET();
+    const body = (await res.json()) as { data: { geo: unknown } };
+    expect(body.data.geo).toEqual({
+      lookup: "online",
+      providerChosen: true,
+      providerHost: "ip-api.com",
+    });
+  });
 });

src/app/api/admin/status/route.ts

@@ -9,6 +9,11 @@ import {
   readFailingQueues,
 } from "@/lib/jobs/job-failures";
 import { readFileSync } from "node:fs";
+import {
+  geoLookupMode,
+  geoProviderChosen,
+  resolveGeoProviderHost,
+} from "@/lib/geo";
 
 // Build timestamp (set at build time via next.config)
 const BUILD_TIME = process.env.BUILD_TIMESTAMP || new Date().toISOString();
@@ -109,5 +114,12 @@ export const GET = apiHandler(async () => {
         : null,
       webPush: webPushConfigured ? { configured: true } : null,
     },
+    // How login IPs are placed on this host. Admin-only: the public
+    // `/api/version` keeps just `offlineGeoEnabled` and `geoProviderHost`.
+    geo: {
+      lookup: geoLookupMode(),
+      providerChosen: geoProviderChosen(),
+      providerHost: resolveGeoProviderHost(),
+    },
   });
 });