fix: serve world-atlas topojson locally to satisfy CSP connect-src

Fetching from cdn.jsdelivr.net was blocked by connect-src 'self'.
Copy countries-110m.json from world-atlas npm package into public/geo/
and reference it as /geo/countries-110m.json instead.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

package-lock.json

@@ -35,7 +35,8 @@
         "drizzle-kit": "^0.31.9",
         "eslint": "^9.39.2",
         "eslint-config-next": "^16.1.3",
-        "typescript": "^5.9.3"
+        "typescript": "^5.9.3",
+        "world-atlas": "^2.0.2"
       }
     },
     "node_modules/@auth/core": {
@@ -8226,6 +8227,13 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/world-atlas": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/world-atlas/-/world-atlas-2.0.2.tgz",
+      "integrity": "sha512-IXfV0qwlKXpckz1FhwXVwKRjiIhOnWttOskm5CtxMsjgE/MXAYRHWJqgXOpM8IkcPBoXnyTU5lFHcYa5ChG0LQ==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",