GeoIP lookup

Server-side proxy for an IP geolocation lookup, used by the Timezone/GeoLocation "Lookup"/"Detect" buttons. ipapi.co is asked first and ipwho.is only if ipapi.co gives no answer (see GeoIPProviders()). It is fetched here rather than from the browser so that only the PLAYER's address is disclosed, and only when somebody presses the button -- and so that no third-party host has to appear in the CSP, which is where the rest of the UI has deliberately ended up. (Both services send Access-Control-Allow-Origin: *, so a browser-side call is not blocked by CORS the way an older comment here claimed; connect-src is the only thing stopping it, and that is ours to decide rather than a technical obstacle.) The response also carries an fpp object naming the settings the lookup implies, so the mapping lives in one place instead of being reimplemented in the browser. Every one of them is a SEED: the buttons fill the fields in, the user sees the result and can change it, and nothing is saved until they finish setup. Any field the lookup cannot determine is simply absent, so the caller leaves that control alone rather than asserting a wrong answer. Note geoip resolves the PUBLIC IP: it says where the device reaches the internet, not where the device is. Fine for something shown and correctable, which is the only way it is used.