Downloads MaxMind databases with the license key and checks releases with HEAD

[jim-toth]

Summary

geo-ip-service now downloads the GeoLite2 databases with the license key alone, so it can run with the key already in use, and it checks for a new release with a HEAD request, which MaxMind does not count against the download limit, before fetching anything else.

Changes

• Downloads use MaxMind's license-key URL (app/geoip_download?edition_id=...&license_key=...&suffix=...). MAXMIND_LICENSE_KEY alone turns downloads on; MAXMIND_ACCOUNT_ID and the Basic auth requests are gone.
• The key is read as a secret, travels only to MaxMind over HTTPS, and is never part of an error message. The logger redacts it wherever it appears, URL-encoded or not, and the redirected file download never carries it.
• An update now runs in three steps:
  1. A HEAD request reads the release from Last-Modified, or Content-Disposition when that is missing. A release matching the one installed last time is unchanged with nothing downloaded.
  2. Otherwise the published checksum is compared as before; this also covers a HEAD answer without either header.
  3. Only a new release downloads the archive.
• The release is kept in each edition's update record and shown under update in /healthz.
• The MaxMind stub serves the license-key URL, answers HEAD with a release date per published archive, and checks the key.
• READMEs: the service README documents the key in the query string and the release check; the service-kit secrets rule names how to handle a provider that accepts a credential only in the URL.

Verified

• bun run check under Bun 1.4.3: typecheck clean, 104 tests pass. Update tests cover:
  • the full request sequence on an empty volume
  • HEAD-only checks when the release is unchanged
  • the checksum comparison when HEAD gives no release
  • the key going only to MaxMind and never to the redirected file host
  • the key absent from every log line in all eight failure scenarios, including a server that repeats it in its error body
• Ran the service against the standalone stub with a one-second schedule: both editions downloaded on an empty volume, then HEAD-only checks reporting unchanged. /healthz shows the recorded release. No log line contains the key.
• One-shot update with a wrong key: 401 from the HEAD request, logged without the key.
• Probed MaxMind's license-key URL with a fake key: it answers HEAD with 401 Invalid license key. Whether a valid key's HEAD answer carries Last-Modified is checked on the first stage deploy; without it, the checksum comparison decides.