GeoIP bindings mishandle private and local-network client IPs

## What

GeoIP bindings/policies mis-handle RFC1918/local-network client IPs (logout, travel-distance, missing geo).

## Want

- GeoIP bindings/policies mis-handle RFC1918/local-network client IPs (logout, travel-distance, missing geo)

## Ideas this came from

- [#13247 GeoIP for filter internal IPs](https://github.com/goauthentik/authentik/issues/13247) — Describe your question/ I created a policy for GeoIP with some countries and the new travel distance feature. I use traefik as my reverse proxy. My problem now
- [#18887 Unable to use GeoIP binding for login stage with local network IP](https://github.com/goauthentik/authentik/issues/18887) — When using GeoIP bindings in the User Login Stage as described here and accessing authentik through the local network (both the client and authentik have a 192.

Start by reproducing the RFC1918/local-network client IP cases described in the issue, including logout, travel-distance, and missing-geo behavior, then trace the GeoIP bindings and policies involved. Done means these scenarios handle private and local-network addresses correctly; no files or tests are named in the issue.

Written by the indexing model from the issue text.