fix(geoip): create GEOIP_DB_DIR before writing — first refresh on a fresh container ENOENTed

[guohai]

Production bug from #149: refreshGeoipDatabases wrote its temp download file into GEOIP_DB_DIR without creating the directory. A fresh container (Coolify's ephemeral filesystem) has no /app/geoip, so the very first startup refresh failed — observed live on prod as ENOENT: ... open '/app/geoip/.tmp-City-*.mmdb', leaving all agents low_confidence/Unverified. Dev never caught it because ./geoip already existed locally.

Fix

fs.mkdir(dir, { recursive: true }) as the first step of the refresh flow, injected through RefreshDeps like the other fs operations so it stays testable. No call-site changes (defaults wired through the spread).

Verification

• RED→GREEN unit test: refresh into a verified-non-existent temp dir — reproduced the ENOENT, then proved dir creation + all files landing (real fs, no mocks).
• Real prod-shape repro: rm -rf ./geoip → dev-server start → startup auto-refresh created the dir and downloaded live DB-IP databases end-to-end.
• 74/74 across geoip-refresh/geoip-live/location suites; npm run check + eslint clean.
• Independent review: approved, zero issues.
• Full pre-merge gate: unit 1792/1805 pass (12 skipped), audio 29/29, E2E 134/148 (13 skipped) — 3 failures all confirmed known-class flakes passing in isolation; zero real regressions.

After merge, the Coolify auto-deploy makes prod self-heal on next start (no manual mkdir needed again).

Generated with SMT smt@agora.build