Axum: follow up with an explicit local GeoIP provider #438

Scope

Track the local-database portion originally proposed in #432, separately from the protected CloudFront Geo provider tracked in #432. Related to #391 and checked ingress #409. CloudFront support does not satisfy this task.

The initial Geo input contains only bounded country and subdivision assertions. A local GeoIP provider needs an explicit input-contract extension for the checked effective reader IP. Reuse checked ingress provenance rather than adding a forwarding-header parser.

Requirements

• Explicit, optional provider selection with no source fallback.
• Operator-supplied, read-only local database; no implicit downloads or external visitor-IP lookup.
• Bounded database preparation and validation before listen/readiness, with source version, licensing and freshness documented.
• Preserve unavailable/error distinctions, no-match behavior, country-only results and unrecognized subdivisions. Applications still own jurisdiction and permission policy.
• Define construction/resource ownership and replacement/restart behavior before adding database lifecycle APIs.
• No coupling to config/KV/secret store registries, identity lifecycle or consent interpretation.

Acceptance

• Reviewed input-contract and startup/lifecycle extension.
• Supported database format, licensing, data freshness and mount guidance.
• IPv4/IPv6, unresolved reader IP, no-match, country/subdivision and country-only fixtures.
• Malformed/unavailable database fails selected startup before readiness.
• Read-only startup and explicit database replacement proof.
• Portable/WASM dependency boundaries and native lifecycle regressions pass.

Trusted Server translation and real policy-path proof remain separate downstream work. This task does not authorize changing fail-closed permission behavior.