refactor(mihomo): link geodata from nixpkgs instead of seeding it by hand

`just mihomo-geo` copied geodata into the state dir so a cold start never
fetched it. tmpfiles now links v2ray-rules-dat and the DB-IP lite mmdbs
there, so geo-auto-update moves to the gateway config only.

Assisted-by: Claude Code (claude-opus-5-5)

Justfile

@@ -322,33 +322,6 @@ mihomo-gen:
   }
   print "validated -- restart: sudo systemctl restart mihomo.service"
 
-# Seed mihomo's geodata into the service's state dir, so a cold start needs no DNS.
-[linux]
-[group('services')]
-mihomo-geo:
-  #!/usr/bin/env nu
-  # Copy geodata in by hand, so a cold start never has to fetch it. The core
-  # fetches it while parsing rules, before its own DNS is up and while the link
-  # DNS points at it -- that fetch can only fail.
-  let src = ($env.HOME | path join .config mihomo)
-  let dst = "/var/lib/private/mihomo"
-  sudo mkdir -p $dst
-  mut seeded = []
-  for f in [GeoSite.dat geoip.metadb ASN.mmdb] {
-    let p = ($src | path join $f)
-    if ($p | path exists) {
-      sudo cp $p $dst
-      $seeded = ($seeded | append ($dst | path join $f))
-    } else {
-      print $"(!) ($f) is not in ($src) -- fetch it first: mihomo -t -d ($src) -f ($src)/config.yaml"
-    }
-  }
-  if ($seeded | is-not-empty) {
-    sudo chmod 644 ...$seeded
-    let names = ($seeded | path basename | str join ', ')
-    print $"seeded ($names) -- restart mihomo to pick them up"
-  }
-
 # Render the mihomo config into a Clash Verge Rev local profile on macOS.
 # sources.yaml comes from the encrypted dotfiles sync (nix-secrets `just restore`).
 [macos]