discriminator: each decision heuristic is its own module (closes #195)

Each discriminator check is now a type in its own file behind one small interface, listed in `heuristics.go`. Adding a heuristic is one file and one line. Behaviour does not change.

Refusal and ban log lines gain `heuristic` and `heuristic_figures`. A ban after the answer, by `refusal_limit` or `byte_limits`, logs `after_answer_heuristic` and its figures, so one line can name both.

Deviation: four lists, not the planned three, so `refusal_limit` still bans at the decision.
Rule suppressed: `//nolint:lll` on one struct tag.

Model: opus-5-5

internal/requestlog/requestlog.go

@@ -131,6 +131,16 @@ type Line struct {
 	// ActionRuleBlocked, ActionWAFBlocked, or, in discriminator, ActionTooLarge
 	// for the header limits.
 	WouldAction string `json:"would_action,omitempty"`
+	// Heuristic is the name of the heuristic that refused the request, in
+	// observe mode too, and HeuristicFigures are the figures it acted on, by
+	// name.
+	Heuristic        string         `json:"heuristic,omitempty"`
+	HeuristicFigures map[string]any `json:"heuristic_figures,omitempty"`
+	// AfterAnswerHeuristic and AfterAnswerHeuristicFigures are the same for
+	// the heuristic that banned the client after discriminator answered the
+	// request.
+	AfterAnswerHeuristic        string         `json:"after_answer_heuristic,omitempty"`
+	AfterAnswerHeuristicFigures map[string]any `json:"after_answer_heuristic_figures,omitempty"` //nolint:lll // a struct tag cannot be split
 	// LimitPercent and LimitPercentSetting are, for a request the rate
 	// limits counted whose client a biased threshold gives a percentage of
 	// the rate limits below 100, that percentage and the setting that gave