fix: harden geoip proxy-free + maximize parity (review follow-ups)

Follow-up fixes for the geoip-no-proxy and start-maximized commits:

- geoip: resolve the egress IP before the DB check so a DB-download failure
  still yields the WebRTC exit IP — the proxy WebRTC spoof survives a DB hiccup
- geoip: skip the exit-IP echo call on no-proxy + explicit tz/locale (the WebRTC
  IP would just be the real connection IP the site already sees — a no-op)
- launch_context: suppress auto --start-maximized when the caller set an explicit
  viewport, matching JS across Python and .NET
- docker: poll for X readiness before starting openbox instead of a blind sleep
  (avoids a silent window-manager startup race)
- refactor: extract the WebRTC exit-IP append into one helper per wrapper
- remove a dead isPrivateIp in the JS wrapper
- tests: fix stale no-proxy geoip assertions; add launch_context parity + .NET
  geoip coverage

Python, JS and .NET wrappers kept in parity.

bin/docker-entrypoint.sh

@@ -9,12 +9,20 @@ rm -f /tmp/.X99-lock /tmp/.X11-unix/X99
 
 # Start Xvfb for headed mode (Turnstile, CAPTCHAs), then run user command
 Xvfb :99 -screen 0 1920x1080x24 -nolisten tcp &
-sleep 1
+
+# Wait for the X server to actually accept connections before starting the WM.
+# A blind `sleep 1` races under a CPU-starved start: openbox can come up before
+# X is ready, fail to connect, and never retry — leaving --start-maximized a
+# silent no-op for the container's whole life. Poll instead (xdotool is already
+# installed and needs a live X server to answer). Bounded to ~10s.
+for _ in $(seq 1 50); do
+  DISPLAY=:99 xdotool getdisplaygeometry >/dev/null 2>&1 && break
+  sleep 0.2
+done
 
 # Window manager so headed --start-maximized is honored (bare Xvfb has no WM;
 # without one the flag is a silent no-op and the window stays un-maximized).
 DISPLAY=:99 openbox &
-sleep 1
 
 # Opt-in: fetch the Widevine CDM so persistent contexts present as a real
 # Chrome (a DRM/EME probe is used by some bot detectors). Off by default — only