Add geolocation & exit node identity check

[francomano]

Description

Add a geolocation check that identifies where the proxy exit node is located — country, city, ISP, ASN — and compares it against the direct connection location.

Users need to verify their proxy exit is in the expected region. Every VPN testing site (ipleak.net, whatismyipaddress) has this. The route_trace plugin already calls ipapi.co for hop geolocation — extending this to the exit IP is natural.

Codebase starting point

• core/checks/public_ip/check.go — template for adapter-based checks, stores public_ip in shared data
• core/checks/register.go — where to register the new check
• core/checks/route_trace/check.go — already calls ipapi.co for hop geolocation, reuse the same API pattern
• core/check/types.go — CategoryGeolocation already defined

Acceptance Criteria

• Create core/checks/geo_identity/check.go implementing check.Checker
• Query a free geolocation API (ipapi.co or ip-api.io, no key needed) with the exit IP
• Return: country, city, ISP, ASN, is_datacenter, latitude/longitude
• If proxy is active, compare exit location vs direct connection location
• If location doesn't match the proxy server's expected region, flag as warning
• Depends on public_ip
• Register in core/checks/register.go
• Add unit tests in core/checks/geo_identity/check_test.go
• Update README.md checks table
• Update NEXT_STEPS.md to mark this as completed