Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

docs/admin-endpoints.md

@@ -5,16 +5,16 @@ The endpoints under `/_sww/`, what each takes and what each answers.
 "Admin endpoints" in [`SPEC.md`](../SPEC.md) says how their tokens work.
 
 - `GET /_sww/healthz`: `200` and `ok`, to anyone.
-- `GET /_sww/metrics`: the metrics, for `SWW_METRICS_TOKEN` (see
+- `GET /_sww/metrics`: the metrics, for `SWW_WAF_METRICS_TOKEN` (see
   [`metrics.md`](metrics.md)).
 - `GET /_sww/bans`: every ban held, under `bans`, each as `bans.json` lists it.
-  Needs `SWW_ADMIN_TOKEN`, as do the three below.
+  Needs `SWW_WAF_ADMIN_TOKEN`, as do the three below.
 - `POST /_sww/bans`: bans a netblock. The body is a JSON object of `netblock`,
   `duration` and, if you like, `reason`. `netblock` is a netblock such as
   `203.0.113.0/24`, or a client's address, which bans its IPv4 netblock
-  (`SWW_BAN_SCOPE_V4_PREFIX`) or its IPv6 group. `duration` is a duration such
-  as `1h` or `7d`, or `permanent`. A bad body is answered `400`, saying what is
-  wrong:
+  (`SWW_WAF_BAN_SCOPE_V4_PREFIX`) or its IPv6 group. `duration` is a duration
+  such as `1h` or `7d`, or `permanent`. A bad body is answered `400`, saying
+  what is wrong:
     - one that is not such an object, or has another field;
     - one longer than 4 KiB;
     - one that names an IPv4-mapped netblock, or an address with a zone.
@@ -38,8 +38,8 @@ in [`SPEC.md`](../SPEC.md)).
 
 ## Examples
 
-With `SWW_ADMIN_TOKEN` set, the token in `$TOKEN`, and `discriminator` reached
-as `discriminator:8080` on its network:
+With `SWW_WAF_ADMIN_TOKEN` set, the token in `$TOKEN`, and `discriminator`
+reached as `discriminator:8080` on its network:
 
 ```sh
 # Every ban.