test(geo): cover countryForLogin and the location parser's refusals

[Amayyas]

What

countryForLogin is the function engine.ts calls to set every card's country, and it had no tests. This adds coverage for it and for the location-parser contracts geo.test.ts didn't yet pin. +11 tests, no source changes.

countryForLogin (was entirely untested)

It layers a pinned-origin override over countryFromLocation. Now pinned:

• the pinned origin wins and ignores the profile location (torvalds → us even with a French location);
• the login match is case-insensitive;
• everyone else falls through to the location parser;
• a non-pinned account with no resolvable location → null.

countryFromLocation — the deliberate refusals

geo.test.ts already covered the UK home nations and the Georgia country-vs-US-state split. What it didn't cover were the design decisions the module's own header comment calls out — and where "a wrong guess is worse than no flag" is the whole point:

• ambiguous 2-letter abbreviations are refused (DE = Germany or Delaware, CA = California or Canada → null), while the intentional uk → gb alias still stands — so the test documents that "drop 2-letter codes" has a deliberate exception, not a bug;
• empty / blank / symbol-only input sanitises to null;
• native-language & colloquial aliases (Deutschland, España, Türkiye, Holland), accented cities (München, Kraków), and multi-word phrases found anywhere in the free text ("based in United Kingdom");
• first resolving segment wins left-to-right ("California, France" → us).

Confidence

Mutation-checked: dropping the pinned override turns the countryForLogin tests red. 276 passed, lint clean, build green.

[Younesfdj]

great work, thanks @Amayyas