Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

internal/remotelog/remotelog.go

@@ -1,5 +1,5 @@
 // Package remotelog sends the lines sww writes on stdout to the
-// remote log endpoint, SWW_LOG_REMOTE_URL, as the "Request log" section
+// remote log endpoint, SWW_WAF_LOG_REMOTE_URL, as the "Request log" section
 // of SPEC.md describes: each line as the message of an RFC 5424 syslog
 // record, over UDP, TCP or TLS. Lines wait in a bounded buffer, so a slow
 // or unreachable endpoint never holds up a request or stdout.
@@ -24,7 +24,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// The forms of SWW_LOG_REMOTE_URL, by its scheme.
+// The forms of SWW_WAF_LOG_REMOTE_URL, by its scheme.
 const (
 	SchemeUDP = "syslog+udp"
 	SchemeTCP = "syslog+tcp"
@@ -56,18 +56,18 @@ const (
 
 // Params are what New needs.
 type Params struct {
-	// URL is the endpoint (SWW_LOG_REMOTE_URL): SchemeUDP, SchemeTCP or
+	// URL is the endpoint (SWW_WAF_LOG_REMOTE_URL): SchemeUDP, SchemeTCP or
 	// SchemeTLS, a host and a port.
 	URL *url.URL
 	// RootCAs are the certificates a SchemeTLS endpoint's certificate
-	// must chain to (SWW_LOG_REMOTE_TLS_CA_FILE), nil for the host's.
+	// must chain to (SWW_WAF_LOG_REMOTE_TLS_CA_FILE), nil for the host's.
 	RootCAs *x509.CertPool
 	// Buffer is the most lines held while they wait to be sent
-	// (SWW_LOG_REMOTE_BUFFER).
+	// (SWW_WAF_LOG_REMOTE_BUFFER).
 	Buffer int
 	// Facility is the number of the records' syslog facility
-	// (SWW_LOG_REMOTE_FACILITY), and AppName their APP-NAME
-	// (SWW_LOG_REMOTE_APP_NAME).
+	// (SWW_WAF_LOG_REMOTE_FACILITY), and AppName their APP-NAME
+	// (SWW_WAF_LOG_REMOTE_APP_NAME).
 	Facility int
 	AppName  string
 }
@@ -243,7 +243,7 @@ func (s *Sender) send(ctx context.Context, processLog *slog.Logger) net.Conn {
 			}
 		}
 
-		processLog.Warn("sending to SWW_LOG_REMOTE_URL failed",
+		processLog.Warn("sending to SWW_WAF_LOG_REMOTE_URL failed",
 			"error", err.Error(), "connecting_again_in", delay.String())
 
 		select {

internal/remotelog/remotelog_test.go

@@ -586,7 +586,7 @@ func wantRetries(t *testing.T, logged *output, delays ...string) {
 		var fields map[string]any
 
 		err := json.Unmarshal([]byte(line), &fields)
-		if err != nil || fields["msg"] != "sending to SWW_LOG_REMOTE_URL failed" {
+		if err != nil || fields["msg"] != "sending to SWW_WAF_LOG_REMOTE_URL failed" {
 			t.Fatalf("logged %q", line)
 		}