feat(geoip/waf): IPinfo single-DB, threat-first enrichment, WAF→firewall offload, log hygiene

[pigri]

Bundles the geoip/threat + log-hygiene work from this session. Default behaviour is unchanged unless noted (opt-in flags, sample-config edits).

GeoIP / threat

• IPinfo Lite + single-DB migration. geoip now decodes the IPinfo Lite combined DB (flat schema — "AS214472" ASN string, top-level country_code) in addition to MaxMind geoip2, detected via db_type. One combined DB (IPinfo Lite or the merged GeoLite2-City-ASN) serves both country + ASN: the ASN lookup falls back to the primary country/city reader when there's no dedicated ASN file. Legacy 3-file configs keep working unchanged. Verified against the real published mmdbs (IPv4 + IPv6 + private-IP skip).
• Sample config switched to ipinfo_lite.mmdb (asn/city unused).
• Threat-first enrichment in kernel_pump: prefer the threat record's context.geo/asn, fall back to the geoip DB only on a miss — mirrors the proxy path and removes "GeoIP no data" for threat-known IPs.

WAF → smart-firewall offload

• On a WAF Block (request / body / response phase), offload the real L4 peer to the kernel smart firewall for a bounded TTL (WAF_BLOCK_OFFLOAD_TTL_SECS = 300), so repeat blocks (e.g. a scanner from a threat-intel block IP) are dropped pre-TLS at L3/L4 instead of re-evaluated at L7 every request.
• No-op unless proxy.waf_firewall_offload.enabled (+ a live firewall); the hook enforces the existing safety allowlist (no CGNAT/shared/own-listener IPs). Only Block is offloaded, never Challenge.

Logging

• blocked.log is now human-readable text (BlockEvent::to_log_line); the OTEL block_event telemetry remains the structured/SIEM stream (all layers incl. smart_firewall).
• Downgraded per-request / periodic chatter to debug: TLS SNI cert-selection, the TCP-fingerprint collector, SSE config-push "re-fetching", routine GeoIP misses, and the WAF "blocked request" line.
• Deprecated the per-type fingerprint/BPF logging config sections (bpf_stats, tcp/ssh/latency/tls/http_fingerprint) in favour of the unified fingerprint_log; sample configs ship them disabled.

Test plan

• cargo fmt --check, cargo clippy clean on all changed crates
• cargo test -p synapse-blocking-log -p synapse-core green (incl. geoip IPinfo-ASN parser)
• geoip validated end-to-end against the published ipinfo_lite.mmdb and merged GeoLite2-City-ASN.mmdb (country + ASN, IPv4 + IPv6, private-IP skip)
• cargo build --release --bin synapse
• Deploy + confirm quiet app.log, human-readable blocked.log, and (with waf_firewall_offload.enabled) kernel drop of repeat-blocked IPs