Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/sww/healthcheck_test.go

@@ -12,6 +12,7 @@ import (
 	"testing"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/config/configtest"
 	"sneak.berlin/go/smallwebwaf/internal/sww"
 )
 
@@ -54,9 +55,9 @@ func TestHealthCheckInWAFsContainer(t *testing.T) {
 	// or invalid token file, or an invalid value of another setting, does not
 	// fail it.
 	for _, other := range []struct{ name, value string }{
-		{"SWW_METRICS_TOKEN_FILE", filepath.Join(t.TempDir(), "removed")},
-		{"SWW_METRICS_TOKEN_FILE", writeFile(t, "too short\n")},
-		{"SWW_MODE", "neither"},
+		{"SWW_WAF_METRICS_TOKEN_FILE", filepath.Join(t.TempDir(), "removed")},
+		{"SWW_WAF_METRICS_TOKEN_FILE", writeFile(t, "too short\n")},
+		{"SWW_WAF_MODE", "neither"},
 	} {
 		wantHealthCheck(t, map[string]string{
 			commandSetting:       wafCommand,
@@ -72,7 +73,7 @@ func TestHealthCheckInWAFsContainer(t *testing.T) {
 	}, 1, "unhealthy: ask waf: ")
 	wantHealthCheck(t, map[string]string{
 		commandSetting: wafCommand, listenAddr: "8080",
-	}, 1, "unhealthy: invalid setting: SWW_LISTEN_ADDR: ")
+	}, 1, "unhealthy: invalid setting: SWW_WAF_LISTEN_ADDR: ")
 
 	stop()
 
@@ -118,8 +119,8 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 	)
 
 	// Another setting does not fail it, even an invalid one, and neither does
-	// SWRP_WAF_BACKEND being unset.
-	wantHealthCheck(t, settings("SWRP_TIMEOUT_MS", "soon"), 0, "")
+	// SWW_RPROXY_WAF_BACKEND being unset.
+	wantHealthCheck(t, settings("SWW_RPROXY_TIMEOUT_MS", "soon"), 0, "")
 
 	// Another test can take a closed server's port at once, so the app's
 	// address here is a multicast address, to which TCP cannot connect.
@@ -135,13 +136,14 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 		"unhealthy: ask rproxy: ",
 	)
 	wantHealthCheck(t, settings(rproxyListenAddr, "8080"), 1,
-		"unhealthy: invalid setting: SWRP_LISTEN_ADDR: ")
+		"unhealthy: invalid setting: SWW_RPROXY_LISTEN_ADDR: ")
 
-	// No setting of rproxy's has a form given as a file.
+	// A setting of rproxy's can be given as a file too, here the listen
+	// address, which the health check reads.
 	wantHealthCheck(t, map[string]string{
 		rproxyListenAddr + "_FILE": writeFile(t, ":"+port+"\n"),
 		rproxyUpstreamURL:          app.URL,
-	}, 1, "unhealthy: ask rproxy: ")
+	}, 0, "")
 }
 
 func TestHealthCheckFailsWithAnyOtherCommand(t *testing.T) {
@@ -157,11 +159,12 @@ func TestHealthCheckRefusesAnArgument(t *testing.T) {
 
 	var stderr bytes.Buffer
 
-	noSettings := func(string) (string, bool) {
-		return "", false
-	}
-
-	got := sww.HealthCheck(t.Context(), []string{"now"}, noSettings, &stderr)
+	got := sww.HealthCheck(
+		t.Context(),
+		[]string{"now"},
+		configtest.Viper(nil),
+		&stderr,
+	)
 
 	want := "sww healthcheck: unexpected argument \"now\"\n"
 	if got != 1 || stderr.String() != want {
@@ -183,16 +186,7 @@ func wantHealthCheck(
 
 	var stderr bytes.Buffer
 
-	got := sww.HealthCheck(
-		t.Context(),
-		nil,
-		func(name string) (string, bool) {
-			value, ok := env[name]
-
-			return value, ok
-		},
-		&stderr,
-	)
+	got := sww.HealthCheck(t.Context(), nil, configtest.Viper(env), &stderr)
 
 	wrote := stderr.String()
 	if got != status || !strings.HasPrefix(wrote, message) ||