feat(geo): bundle GeoLite2-City and add an offline-first lookup path

Rewrites src/lib/geo.ts so lookupIpLocation reads from the bundled
MaxMind GeoLite2-City MMDB first and falls back to the existing
ipwho.is path only for IPs the offline DB cannot resolve. Adds a
sibling lookupIpAsn that returns { asn, carrier } from the
GeoLite2-ASN MMDB so the admin login-overview can grow a carrier
chip alongside the auth-provider chip.

The MMDB files are too large to vendor in git. scripts/fetch-geolite2.sh
downloads them at build time using a MaxMind license key; the
Dockerfile copies assets/geolite2/ into /opt/geolite2/. When the
license key is absent or the files are missing the image still
builds and the resolver falls back to ipwho.is (v1.4.26 behaviour).

GeoLite2 is CC BY-SA 4.0 — attribution lives on the new public
/about page and in docs/audit/v1427-summary.md.

src/proxy.ts

@@ -29,6 +29,10 @@ const PUBLIC_PATHS = [
   // requires a publicly reachable Privacy-Policy URL during submission;
   // GDPR Art. 13 expects the same for any visitor before they sign up.
   "/privacy",
+  // v1.4.27 B3 — `/about` carries the GeoLite2 CC BY-SA 4.0 attribution
+  // alongside the project credits. The CC licence requires the
+  // attribution to be reachable without a sign-in.
+  "/about",
   // `/onboarding` itself + its subroutes are matched exactly via
   // `isPublicPath()` so we don't admit `/onboarding-export` etc.
   "/robots.txt",