Read every setting through viper (closes #211)

servewaf's and rproxy's settings are read through viper, bound to the same environment variable names as before, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set, as it did. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings tests pass set into a viper instead of a lookup function.

Model: deepseek-v4-pro

README.md

@@ -189,12 +189,12 @@ restarting the container. `rproxy` reads only the `SWRP_` settings, and
 default, chosen for a service on the open internet. A setting that needs an
 account, a key, a token or an alert destination stays off until you give one.
 
-- Any `SWWAF_` setting can be given as a file instead, for secrets and long
-  lists: `SWWAF_ADMIN_TOKEN_FILE` names the file that holds `SWWAF_ADMIN_TOKEN`.
-  The file's contents are the value, less one newline at the end. Setting both
-  forms stops the start. `SWWAF_LOG_REMOTE_TLS_CA_FILE` and
-  `SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE` already name a file, so they have no
-  `_FILE` form. No `SWRP_` setting has one, since `rproxy` never touches disk.
+- Any `SWWAF_` or `SWRP_` setting can be given as a file instead, for secrets
+  and long lists: `SWWAF_ADMIN_TOKEN_FILE` names the file that holds
+  `SWWAF_ADMIN_TOKEN`. The file's contents are the value, less one newline at
+  the end. Setting both forms stops the start. `SWWAF_LOG_REMOTE_TLS_CA_FILE`
+  and `SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE` already name a file, so they have no
+  `_FILE` form.
 - A duration is Go's syntax, with `d` for days: `90s`, `15m`, `24h`, `7d`.
 - A size is a number of bytes with an optional `K`, `M` or `G`, in powers of
   1024: `512K`, `100M`, `5G`.