[mkaand]

Summary

• Populate an empty trusted country-header field with CF-IPCountry when Trusted country header mode is selected.
• Preserve existing custom and persisted header values.
• Keep the existing server-side blank-header validation unchanged.

Scope and safety

• The default is an actual input value, not a placeholder.
• No GeoIP resolver, analytics, database, settings persistence, or production configuration behavior changed.
• Public frontend files are unchanged.

Tests

• Added server-rendering coverage for empty, default, and custom trusted-header values plus existing validation paths.
• Added an admin DOM behavior test for the None-to-Trusted transition and custom-header preservation.
• Ran focused PHP and JavaScript tests, Python checks, frontend build/audit checks, and Docker build validation locally.