Validate an IBAN's format and mod-97 checksum, derive its country code, and optionally compare it to an expected country. Format/checksum/country only — no bank-account verification.