Fix missing country: neg cache, geoip2 fallback, re-resolve endpoint

- Add 5-min negative cache (_neg_cache) so failing IPs are throttled
  rather than hammering the API on every request
- Add MaxMind GeoLite2 fallback (init_geoip / _geoip_lookup) that fires
  when ip-api fails; controlled by BANGUI_GEOIP_DB_PATH env var
- Fix lookup_batch bug: failed API results were stored in positive cache
- Add _persist_neg_entry: INSERT OR IGNORE into geo_cache with NULL
  country_code so re-resolve can find historically failed IPs
- Add POST /api/geo/re-resolve: clears neg cache, batch-retries all
  geo_cache rows with country_code IS NULL, returns resolved/total count
- BanTable + MapPage: wrap the country — placeholder in a Fluent UI
  Tooltip explaining the retry behaviour
- Add geoip2>=4.8.0 dependency; geoip_db_path config setting
- Tests: add TestNegativeCache (4), TestGeoipFallback (4), TestReResolve (4)

backend/tests/test_routers/test_geo.py

@@ -157,3 +157,61 @@ class TestGeoLookup:
 
         assert resp.status_code == 200
         assert resp.json()["ip"] == "2001:db8::1"
+
+
+# ---------------------------------------------------------------------------
+# POST /api/geo/re-resolve
+# ---------------------------------------------------------------------------
+
+
+class TestReResolve:
+    """Tests for ``POST /api/geo/re-resolve``."""
+
+    async def test_returns_200_with_counts(self, geo_client: AsyncClient) -> None:
+        """POST /api/geo/re-resolve returns 200 with resolved/total counts."""
+        with patch(
+            "app.routers.geo.geo_service.lookup_batch",
+            AsyncMock(return_value={}),
+        ):
+            resp = await geo_client.post("/api/geo/re-resolve")
+
+        assert resp.status_code == 200
+        data = resp.json()
+        assert "resolved" in data
+        assert "total" in data
+
+    async def test_empty_when_no_unresolved_ips(self, geo_client: AsyncClient) -> None:
+        """Returns resolved=0, total=0 when geo_cache has no NULL country_code rows."""
+        resp = await geo_client.post("/api/geo/re-resolve")
+
+        assert resp.status_code == 200
+        assert resp.json() == {"resolved": 0, "total": 0}
+
+    async def test_re_resolves_null_ips(self, geo_client: AsyncClient) -> None:
+        """IPs with null country_code in geo_cache are re-resolved via lookup_batch."""
+        # Insert a NULL entry into geo_cache.
+        app = geo_client._transport.app  # type: ignore[attr-defined]
+        db: aiosqlite.Connection = app.state.db
+        await db.execute("INSERT OR IGNORE INTO geo_cache (ip) VALUES (?)", ("5.5.5.5",))
+        await db.commit()
+
+        geo_result = {"5.5.5.5": GeoInfo(country_code="FR", country_name="France", asn=None, org=None)}
+        with patch(
+            "app.routers.geo.geo_service.lookup_batch",
+            AsyncMock(return_value=geo_result),
+        ):
+            resp = await geo_client.post("/api/geo/re-resolve")
+
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["total"] == 1
+        assert data["resolved"] == 1
+
+    async def test_401_when_unauthenticated(self, geo_client: AsyncClient) -> None:
+        """POST /api/geo/re-resolve requires authentication."""
+        app = geo_client._transport.app  # type: ignore[attr-defined]
+        resp = await AsyncClient(
+            transport=ASGITransport(app=app),
+            base_url="http://test",
+        ).post("/api/geo/re-resolve")
+        assert resp.status_code == 401