servewaf answers rproxy's question about each request and takes its report (closes #170)

`smallwebwaf servewaf` runs today's checks on the visitor's request each
question carries, answers rproxy, and passes nothing to an app. rproxy reports
every request servewaf answered. A report counts an allowed request's bytes and
writes servewaf's second log line. The table holds a copy of what a report
needs, never the request, so a report cannot reach a request being handled.

Judgement call: a question's body is read before any check; over 64 KiB gets 400.
Judgement call: a report's bytes and durations have ceilings, so they cannot overflow.
Judgement call: a `close` disposition for SWWAF_BAN_RESPONSE=close.

Model: opus-5-5

docs/settings.md

@@ -339,4 +339,22 @@ A few limits are fixed rather than settings:
 - at most 100,000 DNS blocklist verdicts and 100,000 AbuseIPDB scores are kept;
 - at most 1,000 DNS blocklist queries are under way at once;
 - at most 20,000 anomaly counters are kept;
-- each alert destination's queue holds at most 1,000 alerts.
+- each alert destination's queue holds at most 1,000 alerts;
+- `servewaf` holds at most 10,000 answered requests awaiting their reports.
+
+## `servewaf`
+
+`smallwebwaf servewaf` uses every setting here but these, which it ignores:
+
+- `SWWAF_UPSTREAM_URL` and `SWWAF_TRUSTED_PROXIES`;
+- the five timeouts under "Size and time limits";
+- `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES`, `SWWAF_REQUEST_MAX_BYTES` and
+  `SWWAF_RESPONSE_MAX_BYTES`.
+
+An invalid value of one of these still stops the start, and the line of settings
+at start still shows them.
+
+`SWWAF_ADD_LOOKUP_HEADERS` puts the headers on the answer to `rproxy`, not on a
+request to an app. `SWWAF_WAF_BODY_LIMIT` has an effect up to 64 KiB less one
+byte, whatever its value. A question carries no more of a body than 64 KiB (see
+"`servewaf`" in [`SPEC.md`](../SPEC.md)).