rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

docs/alerts.md

@@ -6,7 +6,7 @@ back or dropped.
 
 ## Events
 
-- `ban`: a ban `smallwebwaf` made.
+- `ban`: a ban `servewaf` made.
 - `permanent_ban`: a permanent ban it made, or an existing ban made permanent by
   a request.
 - `waf_block`: the Core Rule Set scored a request at or over the threshold. The
@@ -34,9 +34,10 @@ on one line:
 
 ```json
 {
-    "instance": "fsn1app1/gitea",
+    "instance": "fsn1/servewaf",
     "time": "2026-10-06T12:00:50.123461Z",
     "event": "ban",
+    "host": "app.example",
     "client": "203.0.113.9",
     "netblock": "203.0.113.9/32",
     "asn": "",
@@ -78,9 +79,9 @@ on one line:
 
 - `instance`: `SWWAF_INSTANCE_NAME`. `time`: when the alert was raised. `event`:
   one of the events above.
-- `host`: the site of the request that raised the alert. Only `servewaf` sends
-  this field, since it serves many sites, and not for `source_failure`,
-  `file_error` and `summary`.
+- `host`: the site of the request that raised the alert, since one `servewaf`
+  serves many sites. It is left out of `source_failure`, `file_error` and
+  `summary`.
 - `client`: the address whose request raised the alert. Empty for
   `source_failure`, `file_error` and `summary`.
 - `netblock`: empty for `source_failure`, `file_error` and `summary`; otherwise
@@ -110,7 +111,7 @@ on one line:
 ## Slack and ntfy
 
 Slack and ntfy get a message with a title and a text. The title is the instance
-and the event, such as `fsn1app1/gitea: ban`. The text is the `reason`, then one
+and the event, such as `fsn1/servewaf: ban`. The text is the `reason`, then one
 line for each of these that the alert has:
 
 - the host, the client, the netblock and the country;