KYC onboarding: pre-suggest the user's country from IP geolocation

[TaprootFreak]

Motivation

During KYC onboarding the user fills the country pickers (CountryField): nationality and residence / address country. Today these start empty — PR #519 deliberately removed the previous hardcoded "Switzerland" auto-select because it silently registered every user as a Swiss national/resident.

A better default than "empty" or "always CH" is the country the user is actually in: derive it from the request IP and pre-suggest it.

Proposal

• Detect the user's current country via IP geolocation and pre-suggest it in the onboarding country pickers.
• The suggestion must stay a suggestion the user reviews, never a silent submit — IP is not nationality, and even residence can be wrong (VPN, travel). This keeps the property that made fix(kyc): filter country pickers by allow-flag, harden load states #519 necessary.

Open questions / scope

• Data source. Prefer backend-provided detection (the API already sees the request IP) over shipping a third-party geo-IP dependency in the app — e.g. /v1/country or /v2/user could return a detected country. To be confirmed against the backend.
• Nationality vs. residence. IP is a reasonable proxy for residence but a weak one for nationality. Consider applying the suggestion only to the residence/address field, or clearly marking the nationality suggestion as a guess.
• Allow-flags. The suggested country must satisfy the field's allow-flag (nationalityAllowed / locationAllowed, see fix(kyc): filter country pickers by allow-flag, harden load states #519). If the detected country is not allowed for that purpose, fall back to no pre-selection.
• Privacy. IP-based geolocation is low-sensitivity but should be noted.

Acceptance criteria

• In KYC onboarding, the residence country picker is pre-filled with the IP-detected country when that country is allowed for residence.
• The pre-fill is visible and editable; the user can change it before submitting.
• If detection fails or the detected country is not allowed, the picker falls back to empty (current fix(kyc): filter country pickers by allow-flag, harden load states #519 behaviour).
• A decision is documented on whether the nationality picker also gets a (clearly-marked) suggestion.

Related: #519

[TaprootFreak]

Backend investigation — answers the "data source" open question.

The DFX API already resolves the request IP to a country: it uses geoip-lite2 (geo-location.service.ts, local MaxMind DB, no external call) and persists the result as User.ipCountry (user.service.ts). It is used today for the IP access guard and for default language/currency.

However, ipCountry is not returned in any client-facing DTO — not in /v1/country, not in /v2/user. So the cleanest implementation is to expose the already-detected country in a user/country response, rather than shipping a geo-IP dependency in the app.

The app side confirms there is currently no geolocation: no geolocator/geocoding/IP package in pubspec.yaml, no detection code. A device-location package would also be a poor proxy for nationality/residence and would force OS location permissions — IP-based (backend-provided) is preferable.

Implication: this issue likely needs a small companion change in DFXswiss/api to surface ipCountry.