Full visitor IP sent to third-party geo APIs (one over plaintext HTTP)

Severity: High · Where: collect.ts:164-167 -> utils/geolocation.ts:60,71, geolocation.ts:143 When no CDN geo header is present, getCountryFromIP(ip) is called unconditionally → ipapi.co (HTTPS) and ip-api.com over http://. config.privacy.collectGeolocation (default false) is never consulted; ipAnonymization is wired to nothing. Impact: Breaks "no third-party access / stays in your AWS account" + GDPR/residency claims; leaks full IPs. Fix: Gate behind collectGeolocation, drop the plaintext provider, implement ipAnonymization.