feat(ops-api/audit): annotate audit log IP with region lookup

Add an IPRegionResolver wrapping the ip2region xdb library and attach it
to AuditService so each appended event records both the raw IP and a
resolved region in a new ops.audit_logs.ip_region column. Loopback and
private addresses short-circuit to local labels; missing xdb data or
lookup errors degrade silently so auditing keeps working without it.
The ops console audit view shows the region beneath the IP. Bundle the
v4/v6 xdb data under internal/ops/app/ipregiondata so the resolver works
out of the box, with config paths/env overrides for swapping in updated
data sets.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/migrations_ops/20260429100000_add_ops_audit_ip_region.down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE ops.audit_logs
+    DROP COLUMN IF EXISTS ip_region;

server/migrations_ops/20260429100000_add_ops_audit_ip_region.up.sql

@@ -0,0 +1,2 @@
+ALTER TABLE ops.audit_logs
+    ADD COLUMN ip_region VARCHAR(255);