Rename the program to sww and its deciding daemon to discriminator

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the OS user, and the state and rules directories.
The SWWAF_ environment variables take the SWW_ form.

No logic changes. make check passes.

Model: deepseek-v4-pro

docs/alerts.md

@@ -6,7 +6,7 @@ back or dropped.
 
 ## Events
 
-- `ban`: a ban `servewaf` made.
+- `ban`: a ban `discriminator` made.
 - `permanent_ban`: a permanent ban it made, or an existing ban made permanent by
   a request.
 - `waf_block`: the Core Rule Set scored a request at or over the threshold. The
@@ -34,7 +34,7 @@ on one line:
 
 ```json
 {
-    "instance": "fsn1/servewaf",
+    "instance": "fsn1/discriminator",
     "time": "2026-10-06T12:00:50.123461Z",
     "event": "ban",
     "host": "app.example",
@@ -77,11 +77,11 @@ on one line:
 }
 ```
 
-- `instance`: `SWWAF_INSTANCE_NAME`. `time`: when the alert was raised. `event`:
+- `instance`: `SWW_INSTANCE_NAME`. `time`: when the alert was raised. `event`:
   one of the events above.
-- `host`: the site of the request that raised the alert, since one `servewaf`
-  serves many sites. It is left out of `source_failure`, `file_error` and
-  `summary`.
+- `host`: the site of the request that raised the alert, since one
+  `discriminator` serves many sites. It is left out of `source_failure`,
+  `file_error` and `summary`.
 - `client`: the address whose request raised the alert. Empty for
   `source_failure`, `file_error` and `summary`.
 - `netblock`: empty for `source_failure`, `file_error` and `summary`; otherwise
@@ -111,8 +111,8 @@ on one line:
 ## Slack and ntfy
 
 Slack and ntfy get a message with a title and a text. The title is the instance
-and the event, such as `fsn1/servewaf: ban`. The text is the `reason`, then one
-line for each of these that the alert has:
+and the event, such as `fsn1/discriminator: ban`. The text is the `reason`, then
+one line for each of these that the alert has:
 
 - the host, the client, the netblock and the country;
 - the file, the source, the error and the mode from `detail`;
@@ -122,8 +122,8 @@ Slack gets the title in bold and the text below it, with `&`, `<` and `>`
 escaped. ntfy gets the text as the message, with these headers:
 
 - `Title`: the title;
-- `Authorization`: the token, as `Bearer <token>`, while
-  `SWWAF_ALERT_NTFY_TOKEN` is set;
+- `Authorization`: the token, as `Bearer <token>`, while `SWW_ALERT_NTFY_TOKEN`
+  is set;
 - `Priority` and `Tags`: by event, as listed below.
 
 The priority and tag by event: