refactor(agent): stop embedding GeoIP MMDB in agent binary

Agent ships without City/Country MMDB in the binary; Docker images COPY
databases into data_dir, bare installs seed via download on first start.
Server keeps Country-only embed for optional MaxMind control-plane use.
Also harden fetch script nonempty check and reject non-file MMDB paths.

internal/apps/agent/geoipdata/data.go

@@ -1,16 +1,13 @@
-// Package geoipdata embeds the default MaxMind GeoLite2 databases.
+// Package geoipdata holds shared GeoIP database filename constants.
+//
+// MaxMind MMDB files are NOT embedded into the agent binary. Docker images
+// COPY them onto the default data paths; bare binary installs seed via download
+// on first start (see geoipupdate).
 package geoipdata
 
-import "embed"
-
-// FS holds the embedded GeoLite2 Country and City databases.
-//
-//go:embed GeoLite2-Country.mmdb GeoLite2-City.mmdb
-var FS embed.FS
-
 const (
-	// DefaultMMDBName is the filename of the embedded MaxMind Country database.
+	// DefaultMMDBName is the default Country database filename.
 	DefaultMMDBName = "GeoLite2-Country.mmdb"
-	// DefaultCityMMDBName is the filename of the embedded MaxMind City database.
+	// DefaultCityMMDBName is the default City database filename.
 	DefaultCityMMDBName = "GeoLite2-City.mmdb"
 )

internal/apps/agent/geoipdata/data_test.go

@@ -1,38 +0,0 @@
-package geoipdata
-
-import (
-	"io/fs"
-	"strings"
-	"testing"
-
-	"github.com/oschwald/maxminddb-golang"
-)
-
-func TestEmbeddedDatabasesAreValid(t *testing.T) {
-	tests := []struct {
-		name             string
-		filename         string
-		databaseTypePart string
-	}{
-		{name: "Country", filename: DefaultMMDBName, databaseTypePart: "Country"},
-		{name: "City", filename: DefaultCityMMDBName, databaseTypePart: "City"},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			data, err := fs.ReadFile(FS, test.filename)
-			if err != nil {
-				t.Fatalf("read embedded database: %v", err)
-			}
-			reader, err := maxminddb.FromBytes(data)
-			if err != nil {
-				t.Fatalf("open embedded database: %v", err)
-			}
-			defer reader.Close()
-
-			if !strings.Contains(reader.Metadata.DatabaseType, test.databaseTypePart) {
-				t.Fatalf("unexpected database type %q", reader.Metadata.DatabaseType)
-			}
-		})
-	}
-}