Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/reputation/reputation.go

@@ -1,11 +1,11 @@
 // Package reputation fetches the lists the settings name by URL: the
-// blocklists of SWW_BLOCKLIST_URLS, the file of AS:percent lines
-// SWW_ASN_LIMIT_PERCENT_URL names, the address lists of SWW_TAG_LISTS, and
-// the decision list of the CrowdSec engine SWW_CROWDSEC_LAPI_URL names. It
+// blocklists of SWW_WAF_BLOCKLIST_URLS, the file of AS:percent lines
+// SWW_WAF_ASN_LIMIT_PERCENT_URL names, the address lists of SWW_WAF_TAG_LISTS, and
+// the decision list of the CrowdSec engine SWW_WAF_CROWDSEC_LAPI_URL names. It
 // keeps the last good copy of
 // each, whole, comment lines included, which is used while a fetch fails,
 // and when each was last tried. It also asks the DNSBL zones of
-// SWW_DNSBL_ZONES about clients, and keeps their verdicts, and checks
+// SWW_WAF_DNSBL_ZONES about clients, and keeps their verdicts, and checks
 // clients with AbuseIPDB, and keeps their scores and the checks spent
 // today. The state package writes all of these to reputation.json and
 // reads them from it, so that a restart keeps them too.
@@ -67,20 +67,20 @@ type List struct {
 
 // Params are what New needs.
 type Params struct {
-	// BlocklistURLs are the blocklists (SWW_BLOCKLIST_URLS), and
+	// BlocklistURLs are the blocklists (SWW_WAF_BLOCKLIST_URLS), and
 	// ASNLimitPercentURL the file of AS:percent lines
-	// (SWW_ASN_LIMIT_PERCENT_URL), "" while it is unset.
+	// (SWW_WAF_ASN_LIMIT_PERCENT_URL), "" while it is unset.
 	BlocklistURLs      []string
 	ASNLimitPercentURL string
-	// TagLists are the address lists that add a tag (SWW_TAG_LISTS).
+	// TagLists are the address lists that add a tag (SWW_WAF_TAG_LISTS).
 	TagLists []config.TagList
 	// CrowdSecDecisionsURL is the CrowdSec decision list, "" while
-	// SWW_CROWDSEC_LAPI_URL is unset, fetched with CrowdSecKey
-	// (SWW_CROWDSEC_LAPI_KEY).
+	// SWW_WAF_CROWDSEC_LAPI_URL is unset, fetched with CrowdSecKey
+	// (SWW_WAF_CROWDSEC_LAPI_KEY).
 	CrowdSecDecisionsURL string
 	CrowdSecKey          string
 	// Refresh is how long after a list was last fetched or tried it is
-	// fetched again (SWW_BLOCKLIST_REFRESH), but for the CrowdSec decision
+	// fetched again (SWW_WAF_BLOCKLIST_REFRESH), but for the CrowdSec decision
 	// list, which is fetched again crowdSecRefresh after.
 	Refresh time.Duration
 	// Now tells the time, normally time.Now in UTC.
@@ -155,7 +155,7 @@ func New(params Params) *Lists {
 }
 
 // URLs returns the URL of every list: the blocklists' in the order
-// SWW_BLOCKLIST_URLS names them, then SWW_ASN_LIMIT_PERCENT_URL, then the
+// SWW_WAF_BLOCKLIST_URLS names them, then SWW_WAF_ASN_LIMIT_PERCENT_URL, then the
 // tag lists', then the CrowdSec decision list's.
 func (l *Lists) URLs() []string {
 	urls := slices.Clone(l.params.BlocklistURLs)
@@ -175,7 +175,7 @@ func (l *Lists) URLs() []string {
 }
 
 // ListedBy returns the URLs of the blocklists whose copy lists addr, in
-// the order SWW_BLOCKLIST_URLS names them.
+// the order SWW_WAF_BLOCKLIST_URLS names them.
 func (l *Lists) ListedBy(addr netip.Addr) []string {
 	l.mu.Lock()
 	defer l.mu.Unlock()