main.go now reads top-to-bottom as setup + usage of the three databases (blocklists group, whitelist cohort, geoip readers), then dispatch to one-shot or serve. HTTP server code moved to server.go. No behavior change.
