feat(ops-api/audit): annotate audit log IP with region lookup

Add an IPRegionResolver wrapping the ip2region xdb library and attach it
to AuditService so each appended event records both the raw IP and a
resolved region in a new ops.audit_logs.ip_region column. Loopback and
private addresses short-circuit to local labels; missing xdb data or
lookup errors degrade silently so auditing keeps working without it.
The ops console audit view shows the region beneath the IP. Bundle the
v4/v6 xdb data under internal/ops/app/ipregiondata so the resolver works
out of the box, with config paths/env overrides for swapping in updated
data sets.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/ops/config/config.go

@@ -18,6 +18,7 @@ type Config struct {
 	JWT          JWTConfig                   `mapstructure:"jwt"`
 	DefaultAdmin DefaultAdminConfig          `mapstructure:"default_admin"`
 	AdminUsers   AdminUsersConfig            `mapstructure:"admin_users"`
+	IPRegion     IPRegionConfig              `mapstructure:"ip_region"`
 }
 
 type JWTConfig struct {
@@ -36,6 +37,11 @@ type AdminUsersConfig struct {
 	DefaultPlanCode string `mapstructure:"default_plan_code"`
 }
 
+type IPRegionConfig struct {
+	V4XDBPath string `mapstructure:"v4_xdb_path"`
+	V6XDBPath string `mapstructure:"v6_xdb_path"`
+}
+
 func Load(path string) (*Config, error) {
 	v := viper.New()
 	v.SetConfigFile(path)
@@ -52,6 +58,8 @@ func Load(path string) (*Config, error) {
 	v.SetDefault("default_admin.username", "admin")
 	v.SetDefault("default_admin.display_name", "Administrator")
 	v.SetDefault("admin_users.default_plan_code", "free")
+	v.SetDefault("ip_region.v4_xdb_path", "")
+	v.SetDefault("ip_region.v6_xdb_path", "")
 
 	if err := v.ReadInConfig(); err != nil {
 		return nil, fmt.Errorf("read config: %w", err)
@@ -92,5 +100,11 @@ func applyEnvOverrides(cfg *Config) error {
 	if v := os.Getenv("OPS_ADMIN_USERS_DEFAULT_PLAN_CODE"); v != "" {
 		cfg.AdminUsers.DefaultPlanCode = v
 	}
+	if v := os.Getenv("OPS_IP_REGION_V4_XDB_PATH"); v != "" {
+		cfg.IPRegion.V4XDBPath = v
+	}
+	if v := os.Getenv("OPS_IP_REGION_V6_XDB_PATH"); v != "" {
+		cfg.IPRegion.V6XDBPath = v
+	}
 	return nil
 }