M8: every server we touch is described, located and snapshotted weekly

- Touches: the ledger marks a server as touched when it sends us a verified activity, when
  we exchange activities with it, or when we read its actors, keys, objects or WebFinger.
  It upserts RemoteInstance.Seen, FirstSeenAt and LastSeenAt at most hourly per server, and
  queues one DescribeInstance a week with the same dedupe key ObjectRecords uses. Suspended
  servers and pages behind link previews are never described. Migration _010 marks the
  servers already known as touched, with their dates.
- InstanceDescriber.Describe(host, crawled, allowed) reads:
  - NodeInfo 2.2/2.1/2.0, now with its published user counts, posts, comments,
    description, languages and schema version;
  - for software with a Mastodon API, /api/v2/instance falling back to v1: title,
    languages, registration mode, character limit, API version, source URL.

  It never keeps a contact as a field; the raw document is kept for the admin only. It
  locates the server from the address our connection reached (DB-IP Lite city and ASN, the
  CDN named when fronted) and writes a RemoteInstanceSnapshot per ISO week, unreachable
  weeks included. A crawled server is upserted as crawled only on insert, so it never
  downgrades a touched one, and robots.txt can deny any path.
- PublicGeo.Project is the only public form of a location: a CDN-fronted server shows its
  CDN only, a server reporting at least ten users shows its city, coordinates and network,
  any other only its country.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

PrivaPub/Domain/Statistics/PublicGeo.cs

@@ -0,0 +1,23 @@
+using PrivaPub.Models.Jobs;
+
+namespace PrivaPub.Domain.Statistics
+{
+	public sealed record PublicLocation(string Country, string City, double? Latitude, double? Longitude, string Network, string Cdn);
+
+	public static class PublicGeo
+	{
+		//owner decision: a CDN-fronted server shows only its CDN (the address is an edge), a server reporting at least
+		//minUsers users its city, coordinates and network, any other only its country
+		public static PublicLocation Project(RemoteInstance instance, int minUsers)
+		{
+			var geo = instance?.Geo;
+			if (geo == default)
+				return default;
+			if (geo.Cdn != default)
+				return new PublicLocation(default, default, default, default, default, geo.Cdn);
+			if (instance.UsersTotal >= minUsers)
+				return new PublicLocation(geo.Country, geo.City, geo.Latitude, geo.Longitude, geo.AsnOrg, default);
+			return geo.Country == default ? default : new PublicLocation(geo.Country, default, default, default, default, default);
+		}
+	}
+}