Everything on, phase 1: geolocation fetches itself, the deploy signs in as @thepra, the crawler is on, sign-up by invitation

Owner decisions (2026-10-04, recorded in docs/ROADMAP.md): production runs everything that is built, and nothing waits
on a person running a command.

- Geolocation updates itself. GeoUpdater, a hosted service, checks daily whether each DB-IP Lite database was built this
  month. If not, it fetches this month's, or last month's early in the month. It installs a file only once it opens as
  the right kind of database, then swaps it in atomically, and the locator reloads at once. Lookups now run under the
  lock, so a reload can no longer dispose a reader mid-lookup. The systemd timer, its script and their setup.sh lines
  are gone: the root step they needed never happened, and none is needed now. /stargazing names the database in use.
- The admin CLI runs after the app is built, with every service and nothing started.
  - `create-root <login> [--admin]` takes the password on stdin; it is how the first login is made while sign-up is
    closed.
  - `smoke <persona>` keeps the root `deploy-smoke` and an undiscoverable persona, and gives the root a new password
    on every run.
- The deploy signs in as @thepra. It runs the CLI, gets a token through the real OAuth flow (tools/smoke/oauth.sh,
  moved out of the pasture's privapub_token, which now uses it), checks the signed-in API and that @thepra is
  undiscoverable, then revokes the token. PRIVAPUB_SMOKE_TOKEN is gone.
- The deploy also fails when:
  - NodeInfo and the instance API disagree about registrations;
  - /stargazing does not say the crawler is on;
  - the geolocation databases are missing or more than 40 days old.
- The crawler is on in production, seeded with ten large servers of different kinds. FEDERATION.md now describes it
  and how to opt out.
- One registrations switch (Registrations:Mode, default Invitations; Open in tests and the pasture). It is read by
  open sign-up (403 when closed), NodeInfo `openRegistrations`, and v1 and v2 of the instance API, so they can no longer
  disagree. Before, NodeInfo said open and the instance API said closed. Group invitations always work, so
  invites_enabled is true.
- A persona edit through /clientapi no longer resets what the Mastodon API set (discoverable, locked, quote policy…):
  the theme is merged into the settings instead of replacing them.

650 tests pass. The deploy's smoke step was rehearsed against the pasture's PrivaPub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

PrivaPub/Infrastructure/Geo/GeoLocator.cs

@@ -25,8 +25,8 @@ namespace PrivaPub.Infrastructure.Geo
 
 	public sealed class DbIpLocator : IGeoLocator, IDisposable
 	{
-		public const string CityFile = "dbip-city-lite.mmdb";
-		public const string AsnFile = "dbip-asn-lite.mmdb";
+		public static readonly string CityFile = GeoUpdater.FileOf("city");
+		public static readonly string AsnFile = GeoUpdater.FileOf("asn");
 		static readonly TimeSpan CheckInterval = TimeSpan.FromMinutes(10);
 
 		readonly IOptionsMonitor<StatisticsOptions> _options;
@@ -60,18 +60,17 @@ namespace PrivaPub.Infrastructure.Geo
 			if (address == default || !IpRangeGuard.IsPublic(address))
 				return default;
 			Refresh();
-			Reader city, asn;
-			lock (_lock)
-			{
-				city = _city;
-				asn = _asn;
-			}
-			if (city == default && asn == default)
-				return default;
+			Dictionary<string, object> place, network;
 			try
 			{
-				var place = city?.Find<Dictionary<string, object>>(address);
-				var network = asn?.Find<Dictionary<string, object>>(address);
+				// under the lock, so a reload cannot dispose a reader in the middle of a lookup; lookups are rare
+				lock (_lock)
+				{
+					if (_city == default && _asn == default)
+						return default;
+					place = _city?.Find<Dictionary<string, object>>(address);
+					network = _asn?.Find<Dictionary<string, object>>(address);
+				}
 				var location = Section(place, "location");
 				return new GeoFix(
 					Text(Section(place, "country"), "iso_code"),
@@ -88,6 +87,14 @@ namespace PrivaPub.Infrastructure.Geo
 			}
 		}
 
+		// Looks at the files again now instead of within the next ten minutes: GeoUpdater has just replaced one.
+		public void Reload()
+		{
+			lock (_lock)
+				_checkedAt = DateTime.MinValue;
+			Refresh();
+		}
+
 		void Refresh()
 		{
 			if (DateTime.UtcNow - _checkedAt < CheckInterval)