feat(geoip): country-code enrichment via RIR delegated-stats

Populates Attacker.country_code + country_source (MVP) using the five
RIR delegated-stats files (ARIN/RIPE/APNIC/LACNIC/AFRINIC). Offline,
license-free, no outbound traffic that could burn honeypot stealth.

- decnet.geoip package with factory/base/lookup + rir/ subpackage
  (fetch/parse/provider) mirroring the db + bus factory convention
- Profiler._build_record calls enrich_ip on every upsert
- Idempotent ALTER TABLE migrations for both SQLite and MySQL
- decnet geoip refresh/lookup CLI (master-only)
- /var/lib/decnet/geoip seeded by decnet init
- DECNET_GEOIP_ENABLED=false kill-switch; set in tests/conftest.py so
  unit tests never trigger the first-access fetch

tests/conftest.py

@@ -5,6 +5,15 @@ Env vars required by decnet.env must be set here, at module level, before
 any test file imports decnet.* — pytest loads conftest.py first.
 """
 import os
+import tempfile
+
+# Redirect log paths to a user-writable tempdir so unprivileged test runs
+# (CI, local sans-sudo) don't try to mkdir /var/log/decnet.
+_TEST_LOG_DIR = os.path.join(tempfile.gettempdir(), "decnet-tests-logs")
+os.makedirs(_TEST_LOG_DIR, exist_ok=True)
+os.environ.setdefault("DECNET_LOG_FILE", os.path.join(_TEST_LOG_DIR, "decnet.log"))
+os.environ.setdefault("DECNET_INGEST_LOG_FILE", os.path.join(_TEST_LOG_DIR, "decnet.log"))
+os.environ.setdefault("DECNET_AGENT_LOG_FILE", os.path.join(_TEST_LOG_DIR, "agent.log"))
 
 os.environ["DECNET_JWT_SECRET"] = "stable-test-secret-key-at-least-32-chars-long"
 os.environ["DECNET_ADMIN_PASSWORD"] = "test-password-123"
@@ -12,6 +21,13 @@ os.environ["DECNET_DEVELOPER"] = "true"
 os.environ["DECNET_DEVELOPER_TRACING"] = "false"
 os.environ["DECNET_DB_TYPE"] = "sqlite"
 
+# GeoIP enrichment is offline-by-design (RIR delegated-stats) but the
+# first access triggers a background file fetch. Unit tests must never
+# hit the network and don't care about country codes — disable
+# enrichment globally. The geoip-specific tests re-enable it via
+# monkeypatch + a temp DECNET_GEOIP_ROOT.
+os.environ["DECNET_GEOIP_ENABLED"] = "false"
+
 import pytest
 from typing import Any