SPEC: the one place for behaviour and reasons; docs/ as lookup lists only

docs/core-rule-set.md, docs/lookup.md, docs/reputation.md and docs/bans.md
restated the spec and are folded back into it and removed. The remaining
docs files hold only lists: settings with their defaults and value forms,
the request log's fields, the metrics, the endpoints, the state files and
their contents, the rule file format and default file, the alert events
and messages, the image's contents and pins, and the gitea notes. Every
behaviour each of them held moves to the spec, said once. The settings
groups have the same names in both files. Stale comments in
internal/state and script/example-app point at the right places.

Model: fable-5-1

script/example-app

@@ -87,7 +87,7 @@ start_container() {
 # start_moved_container: run the app's container with the state files on
 # a new volume at /srv/state, which SWWAF_STATE_DIR_FILE names in a file
 # only the smallwebwaf user can read, as under "Settings given as files"
-# in README.md, and wait until it is healthy. smallwebwaf can write the
+# in docs/settings.md, and wait until it is healthy. smallwebwaf can write the
 # new volume only once the run script has given it to that user.
 start_moved_container() {
     docker volume create "$MOVED_VOLUME" >/dev/null