[rennf93]

Closes #148

• feat(ip_gate): RouteIpGate::evaluate_access(ip: Option<IpAddr>, countries, handler) -> RouteAccess, the reference check_route_ip_access with its country arm. The IP-list verdict and the route country verdict are combined (false if either is false, true if either is true, otherwise no verdict), and RouteAccess::country_whitelist_matched carries the reference _route_country_whitelist_matched (skip_countries for the global stage). None is the unknown client identity: denied when the route has an ip_whitelist or whitelist_countries, unrestricted otherwise.
• feat(geo): check_route_country, the reference check_country_access: no handler is no verdict, blocked_countries is asked first, a configured whitelist_countries is false for an unresolved or unlisted country, and there is no loopback exemption.
• feat(ip_gate): IpGateConfig::evaluate_unknown, the global _check_unknown_identity_access: a configured whitelist denies the unknown identity, otherwise it passes with no skip state.

All additive, no new variants in public enums, so the master adapters keep compiling. tests/route_country.rs runs 640 route rows and 45 global rows generated by running the reference (check_route_ip_access, check_ip_access); on master the test does not compile because the API is absent, and the adapters (tower, actix, rocket, 158 of 640 route and 2 of 45 global rows differing) are fixed in their own PRs that need this one first. Fmt, clippy, workspace tests, the three conformance gates, doc, 100% line coverage and the MSRV 1.92 check and test pass locally.