Rename the settings whose names do not say what they control (closes #234)

Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5

internal/ratelimit/ratelimit.go

@@ -25,7 +25,7 @@ const (
 	KindRequests = "requests"
 	// KindBytes is a byte limit, on a client's bytes.
 	KindBytes = "bytes"
-	// KindRefusals is the error burst, on a client's requests sww
+	// KindRefusals is the refusal limit, on a client's requests sww
 	// refused after a rule file match or for a missing or wrong token.
 	KindRefusals = "refusals"
 )
@@ -54,7 +54,7 @@ type Limiter struct {
 
 // Client is a client in the table, as clients.json holds it: its buckets
 // of requests and of bytes in each window, its buckets of refusals in the
-// minute, which the error burst counts, and its history.
+// minute, which the refusal limit counts, and its history.
 //
 //nolint:tagliatelle // the state files use snake_case, as the request log does
 type Client struct {
@@ -121,7 +121,7 @@ type Responses struct {
 //nolint:tagliatelle // the state files use snake_case, as the request log does
 type Offences struct {
 	// Limit is its requests that broke a rate limit, a byte limit or the
-	// error burst, Attack those that were a clear sign of attack, a match
+	// refusal limit, Attack those that were a clear sign of attack, a match
 	// of a ban rule or a request for a trap path, BlockedByBlockRule those a
 	// block rule refused, and BlockedByCoreRuleSet those the Core Rule Set
 	// refused.
@@ -147,7 +147,7 @@ type Request struct {
 	RequestBytes  int64
 	ResponseBytes int64
 	// BrokeLimit is true for a request that broke a rate limit, a byte
-	// limit or the error burst, Attack for one that matched a ban rule or
+	// limit or the refusal limit, Attack for one that matched a ban rule or
 	// asked for a trap path, BlockedByBlockRule for one a block rule refused,
 	// and BlockedByCoreRuleSet for one the Core Rule Set refused.
 	BrokeLimit           bool
@@ -185,11 +185,11 @@ func New(limits Limits, maxClients int) *Limiter {
 	}
 }
 
-// Hit is a request that takes a client over a rate limit or the error
-// burst, or whose bytes take it over a byte limit.
+// Hit is a request that takes a client over a rate limit or the refusal
+// limit, or whose bytes take it over a byte limit.
 type Hit struct {
 	// Kind is KindRequests for a rate limit, KindBytes for a byte limit,
-	// KindRefusals for the error burst.
+	// KindRefusals for the refusal limit.
 	Kind string
 	// Window is "minute", "hour" or "day".
 	Window string
@@ -263,10 +263,10 @@ func (l *Limiter) CountBytes(
 // CountRefusal counts a request from client at now that sww
 // refused after a rule file or Core Rule Set match or for a missing or
 // wrong token, and reports whether the client's refusals in the minute
-// that ends at now, this one included, are more than threshold, which
-// breaks the error burst, and the hit.
+// that ends at now, this one included, are more than limit, which breaks
+// the refusal limit, and the hit.
 func (l *Limiter) CountRefusal(
-	client netip.Prefix, now time.Time, threshold int64,
+	client netip.Prefix, now time.Time, limit int64,
 ) (Hit, bool) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
@@ -275,11 +275,11 @@ func (l *Limiter) CountRefusal(
 	hit := Hit{
 		Kind:   KindRefusals,
 		Window: "minute",
-		Limit:  threshold,
+		Limit:  limit,
 		Count:  count,
 	}
 
-	return hit, count > float64(threshold)
+	return hit, count > float64(limit)
 }
 
 // Reset sets client's counts of requests, of bytes and of refusals in