feat: add GeoIP country lookup with embedded DB-IP Lite database (PLAN.md 4.3)

Embeds a DB-IP Lite country MMDB (~5MB) in the binary via go:embed,
keeping the single-binary deployment story clean. Country codes are
stored alongside login attempts and sessions, shown in the dashboard
(Top IPs, Top Countries card, Recent/Active Sessions, session detail).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/storage/retention_test.go

@@ -22,7 +22,7 @@ func TestRunRetentionDeletesOldRecords(t *testing.T) {
 	}
 
 	// Insert a recent login attempt.
-	if err := store.RecordLoginAttempt(ctx, "new", "new", "2.2.2.2"); err != nil {
+	if err := store.RecordLoginAttempt(ctx, "new", "new", "2.2.2.2", ""); err != nil {
 		t.Fatalf("insert recent attempt: %v", err)
 	}