rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.
Partially verified: make example-app and make gitea-requests never built the image, as Ubuntu's snapshot service answered 5xx.

Model: opus-5-5

internal/proxy/health_test.go

@@ -2,24 +2,18 @@ package proxy_test
 
 import (
 	"net/http"
-	"sync/atomic"
 	"testing"
 
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-func TestHealthEndpointIsAnsweredBeforeAnyCheck(t *testing.T) {
+func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
 	t.Parallel()
 
-	var calls atomic.Int32
-
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {
-		calls.Add(1)
-	})
 	// With a limit of one request a minute, any request counted before
 	// the last one would have it refused.
-	addr, out := startProxy(t, app.URL, map[string]string{rateLimitPerMinute: "1"})
+	s, _, _ := startWithClock(t, "", map[string]string{rateLimitPerMinute: "1"})
 
 	const (
 		healthChecks = 3
@@ -27,8 +21,7 @@ func TestHealthEndpointIsAnsweredBeforeAnyCheck(t *testing.T) {
 	)
 
 	for range healthChecks {
-		got := get(t, addr, proxy.HealthPath)
-		wantStatus(t, got, http.StatusOK)
+		got := s.adminRequest("", http.MethodGet, proxy.HealthPath, "", http.StatusOK)
 
 		if string(got.body) != "ok\n" || got.header.Get("Content-Type") != contentType {
 			t.Errorf("health endpoint answered %q with Content-Type %q, want ok "+
@@ -36,21 +29,12 @@ func TestHealthEndpointIsAnsweredBeforeAnyCheck(t *testing.T) {
 		}
 	}
 
-	wantStatus(t, get(t, addr, "/"), http.StatusOK)
-
-	lines := out.requestLines(t, healthChecks+1)
-	for _, line := range lines[:healthChecks] {
-		wantLine(t, line, http.StatusOK, requestlog.ActionAdmin)
+	s.get(client, http.StatusOK, requestlog.ActionForward)
 
+	for _, line := range s.out.endedLines(t, healthChecks)[:healthChecks] {
 		if line.ResponseContentType != contentType {
 			t.Errorf("health check's log line has response_content_type %q, "+
 				"want %q", line.ResponseContentType, contentType)
 		}
 	}
-
-	wantLine(t, lines[healthChecks], http.StatusOK, requestlog.ActionForward)
-
-	if calls.Load() != 1 {
-		t.Errorf("the app was called %d times, want once", calls.Load())
-	}
 }