feat: add GeoIP country lookup with embedded DB-IP Lite database (PLAN.md 4.3)

Embeds a DB-IP Lite country MMDB (~5MB) in the binary via go:embed,
keeping the single-binary deployment story clean. Country codes are
stored alongside login attempts and sessions, shown in the dashboard
(Top IPs, Top Countries card, Recent/Active Sessions, session detail).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/fetch-geoip.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Downloads the DB-IP Lite country MMDB database for development.
+# The Nix build fetches this automatically; this script is for local dev only.
+set -euo pipefail
+
+URL="https://download.db-ip.com/free/dbip-country-lite-2026-02.mmdb.gz"
+DEST="internal/geoip/dbip-country-lite.mmdb"
+
+cd "$(git rev-parse --show-toplevel)"
+
+if [ -f "$DEST" ]; then
+    echo "GeoIP database already exists at $DEST"
+    exit 0
+fi
+
+echo "Downloading DB-IP Lite country database..."
+curl -fSL "$URL" | gunzip > "$DEST"
+echo "Saved to $DEST"