归属地只用 cleanip.io：移除 MaxMind GeoLite2 与其他在线数据源

- 删掉 MaxMind .mmdb 读取器、本地数据库控制器与「IP 归属地数据库」设置区块，去掉「归属地数据源」选择及 ipapi.is / DB-IP / ipinfo.io 解析；PublicAddressLookup 只向 cleanip.io 查询，结果按 IP 记一小时，收到 429 当天不再请求
- 设置同步文档不再带 geoSource / geoIncludeCity / geoAutoUpdate；公网 IP 缓存键升到第 4 版，旧数据源的缓存不再读取
- 网络详情：IP 地址区块标题不再放 cleanip.io 字标，只留在纯净度区块；纯净度色带改为直角
- 删除 server/geoip 的 GeoLite2 同步脚本；README、架构说明、第三方声明、官网与隐私页、译文同步，清掉 53 条不再使用的翻译

ARCHITECTURE.md

@@ -157,12 +157,10 @@ is open and back to accessory when all are closed.
   sequence number and a random payload token because the kernel rewrites the identifier.
 - **Interface and addresses** — `SCDynamicStore` / `SCPreferences` for the primary and physical
   service, `getifaddrs` for addresses, CoreWLAN for signal and rate.
-- **Public IP** — Cloudflare trace (ipify as fallback) for the address only. Region and ASN come from
-  MaxMind GeoLite2 databases read by `MaxMindDatabase`, a memory-mapped reader of the MaxMind DB
-  format (search tree + data section decoder, no dependencies). `server/geoip/` holds the systemd
-  timer that syncs GeoLite2 onto getopenstats.com with the MaxMind key kept in `/etc/openstats` on the
-  server; the app fetches `geoip/manifest.json`, downloads changed files, verifies sha256 and the
-  database type, then swaps them in. Without a local database it falls back to ipapi.is (anonymous, called directly from each Mac; 30 lookups per client IP per day, so results are cached per IP for 24 h and a 429 stops further calls until the next UTC day). Country
+- **Public IP** — Cloudflare trace (ipify as fallback) for the address only. Location, ASN, network
+  type, native / broadcast and the cleanliness score come from `cleanip.io`, queried directly from each
+  Mac by `PublicAddressLookup` (one request per address family; results are cached per IP for an hour
+  in memory and for a week on disk, and a 429 stops further calls until the next UTC day). Country
   codes are validated before being used as flag file names.
 - **Per-process traffic** — cumulative bytes from `/usr/bin/nettop`, diffed between samples.
 - **DNS** — `networksetup -setdnsservers` through the helper (protocol 3), which re-validates the