SPEC: the one place for behaviour and reasons; docs/ as lookup lists only

docs/core-rule-set.md, docs/lookup.md, docs/reputation.md and docs/bans.md
restated the spec and are folded back into it and removed. The remaining
docs files hold only lists: settings with their defaults and value forms,
the request log's fields, the metrics, the endpoints, the state files and
their contents, the rule file format and default file, the alert events
and messages, the image's contents and pins, and the gitea notes. Every
behaviour each of them held moves to the spec, said once. The settings
groups have the same names in both files. Stale comments in
internal/state and script/example-app point at the right places.

Model: fable-5-1

docs/image.md

@@ -1,56 +1,36 @@
 # What the image holds
 
-The `smallwebwaf` image is the base of each app's own image. The requirements
-are under "Deployment" in [`SPEC.md`](../SPEC.md); this file lists what the
-image holds, how each part is pinned, and why.
+The contents of the `smallwebwaf` image, and how each part is pinned.
+"Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it
+is pinned that way.
 
 ## Contents
 
-- Ubuntu 26.04 LTS, the newest long-term support release of Ubuntu, pinned by
-  digest. The image moves to the next LTS release when that ships.
-- `ca-certificates`, `nix-bin` and `runit` from Ubuntu, installed from a dated
-  snapshot of its archive and checked by hash. The Ubuntu image has no CA
-  certificates; without them Nix cannot download packages and `smallwebwaf`
-  cannot reach GeoJS.
-- Nix and nixpkgs, fixed at one release. Root uses Nix directly; no Nix daemon
-  runs. `nix-bin` creates no build users, so `build-users-group =` in
-  `/etc/nix/nix.conf` lets root build without them.
-- runit, and `runsvinit` as the entrypoint, as the owner's code style guide asks
-  for service containers. No package carries `runsvinit`, so the image builds it
-  from its archived source (`github.com/peterbourgon/runsvinit`, unchanged
-  since 2015) at a fixed commit hash, with a `go.mod` the build writes.
-  `runsvinit` starts runit's `runsvdir`, which runs the `run` script of each
-  directory under `/etc/service` and runs it again whenever it exits. Ubuntu's
-  `sv` looks for services there too.
-- The `smallwebwaf` binary, and a user of its own, `smallwebwaf` (uid and gid
-  65532).
-- The service directory `/etc/service/smallwebwaf`. Its `run` script waits one
-  second (`sleep 1`), makes `SWWAF_STATE_DIR` and every file in it belong to the
-  `smallwebwaf` user, and starts `smallwebwaf` as that user with runit's
-  `chpst`.
-- The directory `/var/lib/smallwebwaf` for the state files, and
-  `/etc/smallwebwaf/rules.d` with the default rule file.
-- Port 8080 declared (`EXPOSE 8080`), and the health check (`HEALTHCHECK`) that
-  "The health check" in `SPEC.md` describes.
+- Ubuntu 26.04 LTS, pinned by digest.
+- `ca-certificates`, `nix-bin` and `runit` from Ubuntu, from the snapshot of its
+  archive at `20261001T000000Z`.
+- Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
+  `nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
+  Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
+  Unpacked, nixpkgs takes about 500 MiB.
+- `runsvinit` as the entrypoint, built from `github.com/peterbourgon/runsvinit`
+  at a fixed commit hash.
+- The `smallwebwaf` binary, and the user `smallwebwaf` (uid and gid 65532).
+- The service directory `/etc/service/smallwebwaf`, with the `run` script
+  `share/smallwebwaf.run`.
+- `/var/lib/smallwebwaf` for the state files, and `/etc/smallwebwaf/rules.d`
+  with the default rule file `share/rules.d/00-default.rules`.
+- `EXPOSE 8080`, and the `HEALTHCHECK` that runs `smallwebwaf healthcheck`.
 
-## Pinning
+## Pins
 
-- Ubuntu's packages come from Ubuntu's snapshot service, the archive as it was
-  at the moment the Dockerfile names (`--snapshot 20261001T000000Z`), never
-  earlier than the pinned Ubuntu image's date. The Dockerfile names the SHA-256
-  hash of each of the snapshot's `InRelease` files, which cover every package
-  list and so every package, and the build checks them before installing. The
-  hashes are the amd64 archive's, so the image is built for amd64 only. The
-  snapshot is fetched over HTTPS with the CA certificates of the Go image that
-  builds `smallwebwaf`, itself pinned by digest, since the Ubuntu image has
-  none.
-- nixpkgs comes from a release file on `releases.nixos.org` (`nixexprs.tar.xz`
-  of `nixos-26.05.11045.774debe7a0d1`), named with its SHA-256 hash, not from a
-  GitHub archive, whose bytes can change. It is set up for root as `nixpkgs`.
-  Root's Nix profile, `/nix/var/nix/profiles/default/bin`, is last on the
-  `PATH`, so that no package hides the image's own commands; busybox's `sv`, for
-  one, looks for services elsewhere. Unpacked, nixpkgs takes about 500 MiB.
-- An app built on the image gets the same packages each time it is built.
-  Security fixes from Ubuntu and nixpkgs come with a newer `smallwebwaf` image,
-  which an app takes by changing the digest in its `FROM` line. The image moves
-  to each new nixpkgs release, every six months.
+- Ubuntu's packages: the snapshot service, `--snapshot 20261001T000000Z` on both
+  `apt-get update` and `apt-get install`. The SHA-256 hash of each of the
+  snapshot's `InRelease` files is named in the `Dockerfile` and checked after
+  `apt-get update`. The hashes are the amd64 archive's.
+- nixpkgs: the release file `nixexprs.tar.xz` of
+  `nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
+  SHA-256 hash.
+- `runsvinit`: the archived repository, unchanged since 2015, at tag `v2.0.0`,
+  by commit hash, with a `go.mod` the build writes.
+- The Go image that builds `smallwebwaf`: by digest.