feat(questions): make brand questions the primary monitoring & template axis

- add /questions/combination-fill endpoint with AI-driven, IP-region-aware matrix fill
- extract ip2region resolver from ops/app into shared/ipregion for cross-service use
- thread question_id filter through dashboard composite, citation summary, and collect-now
- switch template wizard from keyword inputs to brand-question selection (primary + supplemental)
- pass brand_question and supplemental_questions through assist/title/outline prompts
- add AiWaitingModal + 45s client timeout and request_timeout error mapping for long AI flows

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/cmd/ops-api/main.go

@@ -19,6 +19,7 @@ import (
 	sharedauth "github.com/geo-platform/tenant-api/internal/shared/auth"
 	sharedbootstrap "github.com/geo-platform/tenant-api/internal/shared/bootstrap"
 	"github.com/geo-platform/tenant-api/internal/shared/cache"
+	"github.com/geo-platform/tenant-api/internal/shared/ipregion"
 	"github.com/geo-platform/tenant-api/internal/shared/messaging/rabbitmq"
 	"github.com/geo-platform/tenant-api/internal/shared/observability"
 	"github.com/geo-platform/tenant-api/internal/shared/repository/postgres"
@@ -83,11 +84,13 @@ func main() {
 	auditsRepo := repository.NewAuditRepository(pool)
 	siteDomainMappingsRepo := repository.NewSiteDomainMappingRepository(monitoringPool)
 
-	ipRegionResolver, err := app.NewIPRegionResolver(cfg.IPRegion.V4XDBPath, cfg.IPRegion.V6XDBPath, logger)
+	ipRegionResolver, err := ipregion.NewResolver(cfg.IPRegion.V4XDBPath, cfg.IPRegion.V6XDBPath, logger)
 	if err != nil {
 		logger.Sugar().Warnf("ops-api ip2region disabled: %v", err)
 	}
-	defer ipRegionResolver.Close()
+	if ipRegionResolver != nil {
+		defer ipRegionResolver.Close()
+	}
 
 	auditSvc := app.NewAuditService(auditsRepo, logger).WithIPRegionResolver(ipRegionResolver)
 	issuer := app.NewTokenIssuer(cfg.JWT.Secret, cfg.JWT.AccessTTL)