Everything on, phase 1: geolocation fetches itself, the deploy signs in as @thepra, the crawler is on, sign-up by invitation

Owner decisions (2026-10-04, recorded in docs/ROADMAP.md): production runs everything that is built, and nothing waits
on a person running a command.

- Geolocation updates itself. GeoUpdater, a hosted service, checks daily whether each DB-IP Lite database was built this
  month. If not, it fetches this month's, or last month's early in the month. It installs a file only once it opens as
  the right kind of database, then swaps it in atomically, and the locator reloads at once. Lookups now run under the
  lock, so a reload can no longer dispose a reader mid-lookup. The systemd timer, its script and their setup.sh lines
  are gone: the root step they needed never happened, and none is needed now. /stargazing names the database in use.
- The admin CLI runs after the app is built, with every service and nothing started.
  - `create-root <login> [--admin]` takes the password on stdin; it is how the first login is made while sign-up is
    closed.
  - `smoke <persona>` keeps the root `deploy-smoke` and an undiscoverable persona, and gives the root a new password
    on every run.
- The deploy signs in as @thepra. It runs the CLI, gets a token through the real OAuth flow (tools/smoke/oauth.sh,
  moved out of the pasture's privapub_token, which now uses it), checks the signed-in API and that @thepra is
  undiscoverable, then revokes the token. PRIVAPUB_SMOKE_TOKEN is gone.
- The deploy also fails when:
  - NodeInfo and the instance API disagree about registrations;
  - /stargazing does not say the crawler is on;
  - the geolocation databases are missing or more than 40 days old.
- The crawler is on in production, seeded with ten large servers of different kinds. FEDERATION.md now describes it
  and how to opt out.
- One registrations switch (Registrations:Mode, default Invitations; Open in tests and the pasture). It is read by
  open sign-up (403 when closed), NodeInfo `openRegistrations`, and v1 and v2 of the instance API, so they can no longer
  disagree. Before, NodeInfo said open and the instance API said closed. Group invitations always work, so
  invites_enabled is true.
- A persona edit through /clientapi no longer resets what the Mastodon API set (discoverable, locked, quote policy…):
  the theme is merged into the settings instead of replacing them.

650 tests pass. The deploy's smoke step was rehearsed against the pasture's PrivaPub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

PrivaPub.Tests/Infrastructure/GeoUpdaterTests.cs

@@ -0,0 +1,125 @@
+using MaxMind.Db;
+
+using Microsoft.Extensions.Logging.Abstractions;
+
+using PrivaPub.Infrastructure.Geo;
+using PrivaPub.Infrastructure.Statistics;
+using PrivaPub.Tests.Support;
+
+using System.IO.Compression;
+
+namespace PrivaPub.Tests.Infrastructure
+{
+	public sealed class GeoUpdaterTests : IAsyncLifetime
+	{
+		static readonly DateTime Now = new(2026, 10, 4, 12, 0, 0, DateTimeKind.Utc);
+		static readonly DateTime LastMonth = new(2026, 9, 2, 0, 0, 0, DateTimeKind.Utc);
+
+		readonly string _directory = Path.Combine(Path.GetTempPath(), $"privapub-geo-{Guid.NewGuid():N}");
+		Peer _peer;
+		GeoUpdater _updater;
+		DbIpLocator _locator;
+
+		public async ValueTask InitializeAsync()
+		{
+			_peer = await Peer.Start();
+			var options = new StaticOptions<StatisticsOptions>(new StatisticsOptions
+			{
+				GeoDirectory = _directory,
+				Geo = new GeoOptions { DownloadBase = $"{_peer.A}/free" }
+			});
+			_locator = new DbIpLocator(options, NullLogger<DbIpLocator>.Instance);
+			_updater = new GeoUpdater(new Clients(), options, _locator, NullLogger<GeoUpdater>.Instance);
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			_locator?.Dispose();
+			await _peer.DisposeAsync();
+			if (Directory.Exists(_directory))
+				Directory.Delete(_directory, recursive: true);
+		}
+
+		sealed class Clients : IHttpClientFactory
+		{
+			public HttpClient CreateClient(string name) => new();
+		}
+
+		static byte[] Gzip(byte[] bytes)
+		{
+			using var output = new MemoryStream();
+			using (var gzip = new GZipStream(output, CompressionLevel.Fastest))
+				gzip.Write(bytes);
+			return output.ToArray();
+		}
+
+		void Publish(string kind, DateTime month, byte[] database) =>
+			_peer.ServeFile($"/free/dbip-{kind}-lite-{month:yyyy-MM}.mmdb.gz", Gzip(database), "application/gzip");
+
+		static byte[] City(DateTime built) => MiniMmdb.Build("DBIP-City-Lite", built);
+		static byte[] Asn(DateTime built) => MiniMmdb.Build("DBIP-ASN-Lite (compat=GeoLite2-ASN)", built);
+
+		DateTime Built(string kind)
+		{
+			using var reader = new Reader(Path.Combine(_directory, GeoUpdater.FileOf(kind)));
+			return reader.Metadata.BuildDate;
+		}
+
+		[Fact]
+		public async Task Missing_databases_are_fetched_checked_and_read_at_once()
+		{
+			Publish("city", Now, City(Now));
+			Publish("asn", Now, Asn(Now));
+
+			Assert.Equal(2, await _updater.Update(Now, TestContext.Current.CancellationToken));
+
+			Assert.Equal(Now.Date, Built("city").Date);
+			Assert.Equal(Now.Date, Built("asn").Date);
+			Assert.Equal("DB-IP Lite 2026-10", _locator.Source);
+			Assert.Empty(Directory.GetFiles(_directory).Where(f => f.EndsWith(".part") || f.EndsWith(".new")));
+		}
+
+		[Fact]
+		public async Task Early_in_the_month_last_months_database_is_used_and_not_fetched_again()
+		{
+			Publish("city", LastMonth, City(LastMonth));
+			Publish("asn", LastMonth, Asn(LastMonth));
+
+			Assert.Equal(2, await _updater.Update(Now, TestContext.Current.CancellationToken));
+			var asked = _peer.Requests.Count;
+			Assert.Equal(0, await _updater.Update(Now, TestContext.Current.CancellationToken));
+
+			Assert.Equal(LastMonth.Date, Built("city").Date);
+			Assert.DoesNotContain(_peer.Requests.Skip(asked), r => r.Path.Contains("2026-09"));
+		}
+
+		[Fact]
+		public async Task A_current_database_asks_nothing()
+		{
+			Publish("city", Now, City(Now));
+			Publish("asn", Now, Asn(Now));
+			await _updater.Update(Now, TestContext.Current.CancellationToken);
+			var asked = _peer.Requests.Count;
+
+			Assert.Equal(0, await _updater.Update(Now.AddDays(1), TestContext.Current.CancellationToken));
+
+			Assert.Equal(asked, _peer.Requests.Count);
+		}
+
+		[Fact]
+		public async Task A_broken_or_wrong_database_is_refused_and_the_old_one_kept()
+		{
+			Publish("city", LastMonth, City(LastMonth));
+			Publish("asn", LastMonth, Asn(LastMonth));
+			await _updater.Update(LastMonth.AddDays(1), TestContext.Current.CancellationToken);
+			Publish("city", Now, "not a database at all"u8.ToArray());
+			Publish("asn", Now, City(Now));
+
+			Assert.Equal(0, await _updater.Update(Now, TestContext.Current.CancellationToken));
+
+			Assert.Equal(LastMonth.Date, Built("city").Date);
+			Assert.Equal(LastMonth.Date, Built("asn").Date);
+			Assert.Empty(Directory.GetFiles(_directory).Where(f => f.EndsWith(".part") || f.EndsWith(".new")));
+		}
+	}
+}