rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.
Partially verified: make example-app and make gitea-requests never built the image, as Ubuntu's snapshot service answered 5xx.

Model: opus-5-5

internal/state/state_test.go

@@ -648,6 +648,27 @@ func TestClientWithRefusalsInTheMinuteWithoutTheirStartStopsTheStart(t *testing.
 		`: entry 1 has no "minute_refusals.start"`)
 }
 
+func TestClientsJSONFromAnEarlierVersionWithTokenRefusalsLoads(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+
+	err := os.WriteFile(filepath.Join(dir, clientsJSON),
+		[]byte(`{"version": 1, "clients": [{"client": "203.0.113.9/32", `+
+			`"history": {"offences": {"token_refused": 2}}}]}`), 0o600)
+	if err != nil {
+		t.Fatalf("write %s: %v", clientsJSON, err)
+	}
+
+	params := newParams(dir)
+	load(t, params)
+
+	clients := params.Limiter.Snapshot()
+	if len(clients) != 1 || clients[0].History.Offences.TokenRefused != 2 {
+		t.Errorf("clients %+v, want one with its two refusals kept", clients)
+	}
+}
+
 func TestReputationJSONEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
 	t.Parallel()