Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

script/run

@@ -2,11 +2,11 @@
 # script/run: build bin/sww with script/build and run discriminator and
 # rproxy on the host, with the settings in the environment, until rproxy
 # exits or the script is told to stop. rproxy listens on port 8080 unless
-# SWRP_LISTEN_ADDR says otherwise, in front of the app at SWRP_UPSTREAM_URL.
-# discriminator listens on port 8090 unless SWW_LISTEN_ADDR says otherwise, and
-# rproxy asks it there unless SWRP_WAF_BACKEND says otherwise. Unless
-# SWW_STATE_DIR is set, the state files go in bin/state, beside the binary,
-# and unless SWW_RULES_DIR is set, the rule files are those of share/rules.d,
+# SWW_RPROXY_LISTEN_ADDR says otherwise, in front of the app at SWW_RPROXY_UPSTREAM_URL.
+# discriminator listens on port 8090 unless SWW_WAF_LISTEN_ADDR says otherwise, and
+# rproxy asks it there unless SWW_RPROXY_WAF_BACKEND says otherwise. Unless
+# SWW_WAF_STATE_DIR is set, the state files go in bin/state, beside the binary,
+# and unless SWW_WAF_RULES_DIR is set, the rule files are those of share/rules.d,
 # which the image ships.
 set -eu
 
@@ -26,18 +26,18 @@ stop_both() {
 
 main() {
     "$SCRIPT_DIR/build"
-    if [ -z "${SWW_STATE_DIR+set}" ]; then
-        SWW_STATE_DIR="$ROOT/bin/state"
-        export SWW_STATE_DIR
-        mkdir -p "$SWW_STATE_DIR"
+    if [ -z "${SWW_WAF_STATE_DIR+set}" ]; then
+        SWW_WAF_STATE_DIR="$ROOT/bin/state"
+        export SWW_WAF_STATE_DIR
+        mkdir -p "$SWW_WAF_STATE_DIR"
     fi
-    if [ -z "${SWW_RULES_DIR+set}" ]; then
-        SWW_RULES_DIR="$ROOT/share/rules.d"
-        export SWW_RULES_DIR
+    if [ -z "${SWW_WAF_RULES_DIR+set}" ]; then
+        SWW_WAF_RULES_DIR="$ROOT/share/rules.d"
+        export SWW_WAF_RULES_DIR
     fi
-    SWW_LISTEN_ADDR="${SWW_LISTEN_ADDR:-:8090}"
-    SWRP_WAF_BACKEND="${SWRP_WAF_BACKEND:-http://127.0.0.1:${SWW_LISTEN_ADDR##*:}}"
-    export SWW_LISTEN_ADDR SWRP_WAF_BACKEND
+    SWW_WAF_LISTEN_ADDR="${SWW_WAF_LISTEN_ADDR:-:8090}"
+    SWW_RPROXY_WAF_BACKEND="${SWW_RPROXY_WAF_BACKEND:-http://127.0.0.1:${SWW_WAF_LISTEN_ADDR##*:}}"
+    export SWW_WAF_LISTEN_ADDR SWW_RPROXY_WAF_BACKEND
 
     trap stop_both EXIT
     trap 'exit 1' HUP INT TERM