Downloader checks file mtime before fetching (30/day rate limit). Extracts .mmdb atomically from tar.gz, preserving MaxMind's release date as mtime so freshness checks survive restarts. Strips auth header on redirects (302 → Cloudflare R2 presigned URL). Default: 3-day threshold, 5-minute timeout. Also ignores GeoIP.conf and *.mmdb in .gitignore.
