smoke: REST API regression harness + baseline snapshots (Meteor 1.6.1.1)

Adds a standalone Node smoke test (smoke/) that exercises every REST endpoint
consumed by the Flutter app against a seeded local dev server and compares
responses to committed snapshots. This is the safety net for the Meteor upgrade:
it must stay byte-identical after every escala.

- smoke/seed.js: deterministic Mongo seed (fixed ObjectIds, geo indexes)
- smoke/run.js: calls endpoints, normalizes volatile fields, diffs snapshots
- smoke/smoke.sh: seed + run wrapper
- smoke/snapshots/: baseline captured on Meteor 1.6.1.1
- IPGeocoder.js: degrade gracefully when MaxMind DB absent (dev boot)
- settings-development.json: dev-only internalApiToken to enable the REST API
- .meteorignore: exclude smoke/ from the Meteor server build

imports/startup/server/IPGeocoder.js

@@ -21,11 +21,16 @@ function isPrivateIP(ip) {
 const dbpath = '/usr/local/share/maxmind-geolite2/GeoLite2-City.mmdb';
 // const dbpath = `${process.env.PWD}/private/GeoLite2-City.mmdb`;
 
-if (!fs.existsSync(dbpath)) {
+let IPGeocoder;
+if (fs.existsSync(dbpath)) {
+  IPGeocoder = maxmind.openSync(dbpath);
+} else {
+  // In production the DB is provisioned via cron; in local dev it may be
+  // absent. Degrade gracefully instead of crashing at boot: localize() below
+  // already falls back to a default location when no geo data is available.
   console.error(`Maxmind db not found ${dbpath}, download via cron with https://www.npmjs.com/package/maxmind-geolite2-mirror`);
+  IPGeocoder = { get() { return null; } };
 }
-
-const IPGeocoder = maxmind.openSync(dbpath);
 export default IPGeocoder;
 
 // Warning: Meteor cannot access to this.connection with arrow functions
@@ -47,7 +52,7 @@ export function localize() {
   // http://dev.maxmind.com/geoip/geoip2/geolite2/
   const geo = IPGeocoder.get(clientIP);
   // console.warn(geo);
-  if (geo.location && geo.location.latitude && geo.location.longitude) {
+  if (geo && geo.location && geo.location.latitude && geo.location.longitude) {
     return geo;
   }
   // geoIP fallback, Madrid