EU Login Geofencing

Geofence rules -- allow or deny ranges of IPv4/IPv6 addresses by CIDR, or by ISO country code. A built-in EEA allow-list (27 EU member states + IS/LI/NO) lets you restrict access to the European Economic Area in one click. Per-user & per-group policy -- apply the geofence to everyone, to a group, or to named users (e.g. only restrict the Settings/admin group). Access log -- every login attempt is recorded with timestamp, login, IP, resolved country, matched rule and outcome (allowed / denied / flagged), giving a defensible residency audit trail. Evaluation engine -- a pure, testable engine resolves an IP against the rules (longest-prefix CIDR match, country match, default policy) and against optional time-of-day windows; an out-of-policy login can be denied or merely logged in 'monitor' mode.