feat: add GeoIP country lookup with embedded DB-IP Lite database (PLAN.md 4.3)

Embeds a DB-IP Lite country MMDB (~5MB) in the binary via go:embed,
keeping the single-binary deployment story clean. Country codes are
stored alongside login attempts and sessions, shown in the dashboard
(Top IPs, Top Countries card, Recent/Active Sessions, session detail).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -50,6 +50,12 @@ Key settings:
 - `detection.update_interval` — how often to recompute scores (default `5s`)
 - `notify.webhooks` — list of webhook endpoints for notifications (see example config)
 
+### GeoIP
+
+Country-level GeoIP lookups are embedded in the binary using the [DB-IP Lite](https://db-ip.com/db/lite.php) database (CC-BY-4.0). The dashboard shows country alongside IPs and includes a "Top Countries" table.
+
+For local development, run `scripts/fetch-geoip.sh` to download the MMDB file. The Nix build fetches it automatically.
+
 ### Run
 
 ```sh