feat(ops-api/audit): annotate audit log IP with region lookup

Add an IPRegionResolver wrapping the ip2region xdb library and attach it
to AuditService so each appended event records both the raw IP and a
resolved region in a new ops.audit_logs.ip_region column. Loopback and
private addresses short-circuit to local labels; missing xdb data or
lookup errors degrade silently so auditing keeps working without it.
The ops console audit view shows the region beneath the IP. Bundle the
v4/v6 xdb data under internal/ops/app/ipregiondata so the resolver works
out of the box, with config paths/env overrides for swapping in updated
data sets.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/ops/domain/types.go

@@ -35,6 +35,7 @@ type AuditEvent struct {
 	TargetID     string
 	Metadata     map[string]any
 	IP           string
+	IPRegion     string
 	UserAgent    string
 	RequestID    string
 }
@@ -48,6 +49,7 @@ type AuditLog struct {
 	TargetID     *string
 	Metadata     map[string]any
 	IP           *string
+	IPRegion     *string
 	UserAgent    *string
 	RequestID    *string
 	CreatedAt    time.Time