Fix geolocation to resolve public IP for localhost/LAN clients

When the client IP is private (127.0.0.1, 192.168.x.x, etc.), the
geolocation endpoint now discovers the server's public IP via
api.ipify.org before querying ip-api.com. This fixes the issue where
local development always fell back to New York.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/api/geolocation.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import ipaddress
 import math
 
 import httpx
@@ -12,7 +13,7 @@ from ..data_loader import get_route_graph
 
 router = APIRouter(prefix="/api/geolocation", tags=["geolocation"])
 
-# Fallback for private / unresolvable IPs
+# Fallback for truly unresolvable cases
 _FALLBACK = {
     "country_code": "US",
     "city": "New York",
@@ -22,6 +23,14 @@ _FALLBACK = {
 }
 
 
+def _is_private_ip(ip_str: str) -> bool:
+    """Check if an IP address is private/loopback/reserved."""
+    try:
+        return ipaddress.ip_address(ip_str).is_private
+    except ValueError:
+        return True
+
+
 def _haversine_km(lat1: float, lon1: float, lat2: float, lon2: float) -> float:
     """Great-circle distance in km between two lat/lon points."""
     r = 6371.0
@@ -52,6 +61,21 @@ def _nearest_airports(lat: float, lon: float, limit: int = 3) -> list[dict]:
     ]
 
 
+async def _resolve_ip(client_ip: str) -> str:
+    """If client_ip is private (localhost, LAN), discover the public IP."""
+    if not _is_private_ip(client_ip):
+        return client_ip
+    # Ask ip-api.com without an IP — it returns the server's public IP info
+    # Or use a lightweight service to get the public IP first
+    try:
+        async with httpx.AsyncClient(timeout=3.0) as client:
+            resp = await client.get("https://api.ipify.org?format=json")
+            data = resp.json()
+            return data.get("ip", client_ip)
+    except Exception:
+        return client_ip
+
+
 @router.get("")
 async def geolocate(request: Request):
     """Resolve client IP to location, currency, and nearest airports."""
@@ -60,10 +84,13 @@ async def geolocate(request: Request):
     if not client_ip:
         client_ip = request.client.host if request.client else "127.0.0.1"
 
+    # If IP is private (localhost/LAN), resolve to public IP
+    lookup_ip = await _resolve_ip(client_ip)
+
     # Try ip-api.com (free, no key, 45 req/min)
     try:
         async with httpx.AsyncClient(timeout=3.0) as client:
-            resp = await client.get(f"http://ip-api.com/json/{client_ip}?fields=status,country,countryCode,city,lat,lon")
+            resp = await client.get(f"http://ip-api.com/json/{lookup_ip}?fields=status,country,countryCode,city,lat,lon")
             data = resp.json()
             if data.get("status") == "success":
                 country_code = data.get("countryCode", "US")