Region-based inbound filtering

### Problem Statement

We have recurring bot traffic from non-operated regions that pollutes CFSR and other metrics. The current mitigation (IP-based filtering) is brittle, bots rotate IPs and teams are continually chasing new IPs to keep metrics clean. We need a safer, lower-maintenance way to exclude traffic from whole regions (country/geo) at ingestion time.

### Solution Brainstorm

_No response_

### Product Area

Unknown

No files, tests, or entry points are named. Start by locating the ingestion path and existing IP-based filtering, then clarify how country or geo regions should be identified and configured. Done should mean an agreed, safer region-based filtering design with coverage for the relevant ingestion behavior.

Written by the indexing model from the issue text.