Rename the program to sww and its deciding daemon to discriminator

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the OS user, and the state and rules directories.
The SWWAF_ environment variables take the SWW_ form.

No logic changes. make check passes.

Model: deepseek-v4-pro

script/run

@@ -1,50 +1,50 @@
 #!/bin/sh
-# script/run: build bin/smallwebwaf with script/build and run servewaf and
+# script/run: build bin/sww with script/build and run discriminator and
 # rproxy on the host, with the settings in the environment, until rproxy
 # exits or the script is told to stop. rproxy listens on port 8080 unless
 # SWRP_LISTEN_ADDR says otherwise, in front of the app at SWRP_UPSTREAM_URL.
-# servewaf listens on port 8090 unless SWWAF_LISTEN_ADDR says otherwise, and
+# discriminator listens on port 8090 unless SWW_LISTEN_ADDR says otherwise, and
 # rproxy asks it there unless SWRP_WAF_BACKEND says otherwise. Unless
-# SWWAF_STATE_DIR is set, the state files go in bin/state, beside the binary,
-# and unless SWWAF_RULES_DIR is set, the rule files are those of share/rules.d,
+# SWW_STATE_DIR is set, the state files go in bin/state, beside the binary,
+# and unless SWW_RULES_DIR is set, the rule files are those of share/rules.d,
 # which the image ships.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
-SERVEWAF=""
+DISCRIMINATOR=""
 RPROXY=""
 
-# stop_both: stop what runs, and wait for it, so that servewaf writes its state
+# stop_both: stop what runs, and wait for it, so that discriminator writes its state
 # files.
 stop_both() {
     trap '' HUP INT TERM
-    kill $SERVEWAF $RPROXY 2>/dev/null || true
+    kill $DISCRIMINATOR $RPROXY 2>/dev/null || true
     wait || true
 }
 
 main() {
     "$SCRIPT_DIR/build"
-    if [ -z "${SWWAF_STATE_DIR+set}" ]; then
-        SWWAF_STATE_DIR="$ROOT/bin/state"
-        export SWWAF_STATE_DIR
-        mkdir -p "$SWWAF_STATE_DIR"
+    if [ -z "${SWW_STATE_DIR+set}" ]; then
+        SWW_STATE_DIR="$ROOT/bin/state"
+        export SWW_STATE_DIR
+        mkdir -p "$SWW_STATE_DIR"
     fi
-    if [ -z "${SWWAF_RULES_DIR+set}" ]; then
-        SWWAF_RULES_DIR="$ROOT/share/rules.d"
-        export SWWAF_RULES_DIR
+    if [ -z "${SWW_RULES_DIR+set}" ]; then
+        SWW_RULES_DIR="$ROOT/share/rules.d"
+        export SWW_RULES_DIR
     fi
-    SWWAF_LISTEN_ADDR="${SWWAF_LISTEN_ADDR:-:8090}"
-    SWRP_WAF_BACKEND="${SWRP_WAF_BACKEND:-http://127.0.0.1:${SWWAF_LISTEN_ADDR##*:}}"
-    export SWWAF_LISTEN_ADDR SWRP_WAF_BACKEND
+    SWW_LISTEN_ADDR="${SWW_LISTEN_ADDR:-:8090}"
+    SWRP_WAF_BACKEND="${SWRP_WAF_BACKEND:-http://127.0.0.1:${SWW_LISTEN_ADDR##*:}}"
+    export SWW_LISTEN_ADDR SWRP_WAF_BACKEND
 
     trap stop_both EXIT
     trap 'exit 1' HUP INT TERM
 
-    "$ROOT/bin/smallwebwaf" servewaf &
-    SERVEWAF=$!
-    "$ROOT/bin/smallwebwaf" rproxy &
+    "$ROOT/bin/sww" discriminator &
+    DISCRIMINATOR=$!
+    "$ROOT/bin/sww" rproxy &
     RPROXY=$!
     wait "$RPROXY"
 }