Everything on, phase 1: geolocation fetches itself, the deploy signs in as @thepra, the crawler is on, sign-up by invitation

Owner decisions (2026-10-04, recorded in docs/ROADMAP.md): production runs everything that is built, and nothing waits
on a person running a command.

- Geolocation updates itself. GeoUpdater, a hosted service, checks daily whether each DB-IP Lite database was built this
  month. If not, it fetches this month's, or last month's early in the month. It installs a file only once it opens as
  the right kind of database, then swaps it in atomically, and the locator reloads at once. Lookups now run under the
  lock, so a reload can no longer dispose a reader mid-lookup. The systemd timer, its script and their setup.sh lines
  are gone: the root step they needed never happened, and none is needed now. /stargazing names the database in use.
- The admin CLI runs after the app is built, with every service and nothing started.
  - `create-root <login> [--admin]` takes the password on stdin; it is how the first login is made while sign-up is
    closed.
  - `smoke <persona>` keeps the root `deploy-smoke` and an undiscoverable persona, and gives the root a new password
    on every run.
- The deploy signs in as @thepra. It runs the CLI, gets a token through the real OAuth flow (tools/smoke/oauth.sh,
  moved out of the pasture's privapub_token, which now uses it), checks the signed-in API and that @thepra is
  undiscoverable, then revokes the token. PRIVAPUB_SMOKE_TOKEN is gone.
- The deploy also fails when:
  - NodeInfo and the instance API disagree about registrations;
  - /stargazing does not say the crawler is on;
  - the geolocation databases are missing or more than 40 days old.
- The crawler is on in production, seeded with ten large servers of different kinds. FEDERATION.md now describes it
  and how to opt out.
- One registrations switch (Registrations:Mode, default Invitations; Open in tests and the pasture). It is read by
  open sign-up (403 when closed), NodeInfo `openRegistrations`, and v1 and v2 of the instance API, so they can no longer
  disagree. Before, NodeInfo said open and the instance API said closed. Group invitations always work, so
  invites_enabled is true.
- A persona edit through /clientapi no longer resets what the Mastodon API set (discoverable, locked, quote policy…):
  the theme is merged into the settings instead of replacing them.

650 tests pass. The deploy's smoke step was rehearsed against the pasture's PrivaPub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

PrivaPub/Services/ClientToServer/Private/IPrivateAvatarUsersService.cs

@@ -73,7 +73,7 @@ namespace PrivaPub.Services.ClientToServer.Private
 				if (!await _localActors.TryReserveUserName(userName, LocalActorKind.Person, newAvatar.ID, default))
 					return result.Invalidate(_localizer["The username '{0}' is already take.", userName]);
 				if (form.Settings is { IsDefault: false })
-					newAvatar.Settings = ToSettings(form.Settings);
+					Apply(newAvatar.Settings, form.Settings);
 
 				var actor = _localActors.FromAvatar(newAvatar);
 				newAvatar.Url = actor.Uri;
@@ -116,7 +116,7 @@ namespace PrivaPub.Services.ClientToServer.Private
 				avatar.Fields = form.Fields ?? new();
 				avatar.PersonalNote = form.PersonalNote;
 				if (form.Settings != default)
-					avatar.Settings = ToSettings(form.Settings);
+					Apply(avatar.Settings ??= new(), form.Settings);
 				avatar.UpdatedAt = DateTime.UtcNow;
 				await DB.Default.SaveAsync(avatar);
 				await _outbox.PublishProfile(_localActors.FromAvatar(avatar), default);
@@ -158,18 +158,20 @@ namespace PrivaPub.Services.ClientToServer.Private
 				.Match(ru => !ru.DeletedAt.HasValue && !ru.IsBanned)
 				.ExecuteAnyAsync();
 
-		static AvatarSettings ToSettings(ViewAvatarSettings settings) => new()
+		// The client API carries only the theme; the rest (discoverable, locked, quote policy…) is set through the Mastodon API
+		// and must survive an edit made here.
+		static void Apply(AvatarSettings target, ViewAvatarSettings settings)
 		{
-			IsDefault = settings.IsDefault,
-			DarkThemeIndexColour = settings.DarkThemeIndexColour,
-			IconsThemeIndexColour = settings.IconsThemeIndexColour,
-			LanguageCode = settings.LanguageCode,
-			LightThemeIndexColour = settings.LightThemeIndexColour,
-			PreferSystemTheming = settings.PreferSystemTheming,
-			ThemeIsDarkGray = settings.ThemeIsDarkGray,
-			ThemeIsDarkMode = settings.ThemeIsDarkMode,
-			ThemeIsLightGray = settings.ThemeIsLightGray
-		};
+			target.IsDefault = settings.IsDefault;
+			target.DarkThemeIndexColour = settings.DarkThemeIndexColour;
+			target.IconsThemeIndexColour = settings.IconsThemeIndexColour;
+			target.LanguageCode = settings.LanguageCode;
+			target.LightThemeIndexColour = settings.LightThemeIndexColour;
+			target.PreferSystemTheming = settings.PreferSystemTheming;
+			target.ThemeIsDarkGray = settings.ThemeIsDarkGray;
+			target.ThemeIsDarkMode = settings.ThemeIsDarkMode;
+			target.ThemeIsLightGray = settings.ThemeIsLightGray;
+		}
 
 		ViewAvatar ToView(Avatar avatar) => new()
 		{