Rename the program to sww and its deciding daemon to discriminator

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the OS user, and the state and rules directories.
The SWWAF_ environment variables take the SWW_ form.

No logic changes. make check passes.

Model: deepseek-v4-pro

internal/ratelimit/ratelimit.go

@@ -2,7 +2,7 @@
 // and bytes counted over a minute, an hour and a day, as the "Counting
 // method" section of SPEC.md describes, which tell when a request takes
 // the client over a rate limit or a byte limit, and each client's history
-// since it was first seen. At most SWWAF_MAX_TRACKED_CLIENTS clients are
+// since it was first seen. At most SWW_MAX_TRACKED_CLIENTS clients are
 // kept, in memory, and written to clients.json and read from it by the
 // state package.
 package ratelimit
@@ -25,7 +25,7 @@ const (
 	KindRequests = "requests"
 	// KindBytes is a byte limit, on a client's bytes.
 	KindBytes = "bytes"
-	// KindRefusals is the error burst, on a client's requests smallwebwaf
+	// KindRefusals is the error burst, on a client's requests sww
 	// refused after a rule file match or for a missing or wrong token.
 	KindRefusals = "refusals"
 )
@@ -92,9 +92,9 @@ type History struct {
 	ASName   string    `json:"as_name,omitempty"`
 	Country  string    `json:"country,omitempty"`
 	LookedUp time.Time `json:"looked_up,omitzero"`
-	// Requests are all the client's requests: Forwarded those servewaf allowed,
+	// Requests are all the client's requests: Forwarded those discriminator allowed,
 	// Refused those it refused, and neither those for a path under
-	// /_smallwebwaf/.
+	// /_sww/.
 	Requests  int64 `json:"requests"`
 	Forwarded int64 `json:"forwarded"`
 	Refused   int64 `json:"refused"`
@@ -135,8 +135,8 @@ type Offences struct {
 
 // Request is what a client's history keeps of one of its requests.
 type Request struct {
-	// Forwarded is true for a request servewaf allowed, and Refused for one it
-	// refused. Both are false for a request for a path under /_smallwebwaf/.
+	// Forwarded is true for a request discriminator allowed, and Refused for one it
+	// refused. Both are false for a request for a path under /_sww/.
 	Forwarded bool
 	Refused   bool
 	// Status is what the client was sent, 0 if nothing was.
@@ -156,7 +156,7 @@ type Request struct {
 }
 
 // New returns a Limiter for limits, with no client counted yet, whose
-// table holds at most maxClients clients (SWWAF_MAX_TRACKED_CLIENTS). Past
+// table holds at most maxClients clients (SWW_MAX_TRACKED_CLIENTS). Past
 // it, the least recently seen client is dropped, with its history, and
 // starts afresh if it comes back.
 func New(limits Limits, maxClients int) *Limiter {
@@ -258,7 +258,7 @@ func (l *Limiter) CountBytes(
 	return l.count(client, now, 0, bytes, percent)
 }
 
-// CountRefusal counts a request from client at now that smallwebwaf
+// CountRefusal counts a request from client at now that sww
 // refused after a rule file or Core Rule Set match or for a missing or
 // wrong token, and reports whether the client's refusals in the minute
 // that ends at now, this one included, are more than threshold, which