Add unified analytics system with GeoIP geo-tracking

Full analytics platform with MaxMind GeoLite2 IP-to-location resolution,
cross-module dashboard (docs, video, photo), user drill-down, volunteer
self-service stats, and ANALYTICS_ADMIN role with feature flag controls.

- ANALYTICS_ADMIN role + ANALYTICS_ROLES group across backend and frontend
- GeoIP service (MaxMind GeoLite2, lazy-loaded, graceful degradation)
- Geo fields (country, region, city, lat/lng) on DocsPageView, VideoView, PhotoView
- IP resolved to geo before SHA-256 hashing (privacy-preserving)
- Unified analytics module: overview, geo, content, user engagement endpoints
- 4 admin dashboard pages: Overview, Geography (Leaflet map), Content, Users
- Volunteer MyAnalyticsPage for self-service activity stats
- Settings UI: enableAnalytics, analyticsGeoEnabled, trackAuthenticatedUsers, retentionDays
- Scheduled cleanup job respecting configurable retention period
- config.sh: Analytics + MaxMind prompt in configure_features()
- Control panel: enableAnalytics flag, template, discovery, wizard, detail page
- Docker: geoip volume mount, MaxMind env vars, entrypoint auto-download
- Nginx: X-Forwarded-For fix ($proxy_add_x_forwarded_for) for real client IP
- Express trust proxy set to 2 for Pangolin/Newt tunnel chain
- CORS updated for docs origin (cmlite.org + docs.cmlite.org)
- Lander page: added docs-analytics tracking snippet
- Prisma migration: 20260402100000_add_analytics_system

Bunker Admin

.env.example

@@ -420,3 +420,8 @@ GOTIFY_ADMIN_PASSWORD=REQUIRED_STRONG_PASSWORD_CHANGE_THIS
 INSTANCE_LABEL=               # Unique label for this instance (defaults to DOMAIN)
 BUNKER_OPS_ENABLED=false      # Enable remote metrics push to central server
 BUNKER_OPS_REMOTE_WRITE_URL=  # VictoriaMetrics remote_write endpoint (e.g., https://ops.example.com/api/v1/write)
+
+# --- GeoIP (MaxMind GeoLite2) ---
+# Free account: https://www.maxmind.com/en/geolite2/signup
+MAXMIND_ACCOUNT_ID=           # MaxMind account ID
+MAXMIND_LICENSE_KEY=          # MaxMind license key (auto-downloads GeoLite2-City DB at startup)