04272ae673
detectLocation() fetched http://ip-api.com over plaintext from an HTTPS storefront. Browsers block mixed active content, so the request never completed and auto-detect only ever took its error branch - region detection has been dead in production, not merely insecure. The attempt also handed every visitor's IP to a third party from the page itself. Geo now resolves through the tenant API at {baseUrl}/geo/resolve, the same base /regions already uses. The server reads the client IP; the browser sends nothing and receives no third-party payload. The endpoint is specified in BACKEND-API-REFERENCE.md and is not built yet. Until it ships the client falls back to the manual region picker - identical to the behaviour production already had. Adds location.service.spec.ts: geo goes to the tenant API, no request leaves that origin or uses http://, failure degrades to the manual picker, and detection is not retried once attempted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>