Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

internal/reputation/reputation.go

@@ -1,10 +1,10 @@
 // Package reputation fetches the lists the settings name by URL: the
-// blocklists of SWW_BLOCKLIST_URLS, the file of AS:percent lines
-// SWW_ASN_LIMIT_PERCENT_URL names, and the decision list of the CrowdSec
-// engine SWW_CROWDSEC_LAPI_URL names. It keeps the last good copy of
+// blocklists of SWW_WAF_BLOCKLIST_URLS, the file of AS:percent lines
+// SWW_WAF_ASN_LIMIT_PERCENT_URL names, and the decision list of the CrowdSec
+// engine SWW_WAF_CROWDSEC_LAPI_URL names. It keeps the last good copy of
 // each, whole, comment lines included, which is used while a fetch fails,
 // and when each was last tried. It also asks the DNSBL zones of
-// SWW_DNSBL_ZONES about clients, and keeps their verdicts, and checks
+// SWW_WAF_DNSBL_ZONES about clients, and keeps their verdicts, and checks
 // clients with AbuseIPDB, and keeps their scores and the checks spent
 // today. The state package writes all of these to reputation.json and
 // reads them from it, so that a restart keeps them too.
@@ -66,18 +66,18 @@ type List struct {
 
 // Params are what New needs.
 type Params struct {
-	// BlocklistURLs are the blocklists (SWW_BLOCKLIST_URLS), and
+	// BlocklistURLs are the blocklists (SWW_WAF_BLOCKLIST_URLS), and
 	// ASNLimitPercentURL the file of AS:percent lines
-	// (SWW_ASN_LIMIT_PERCENT_URL), "" while it is unset.
+	// (SWW_WAF_ASN_LIMIT_PERCENT_URL), "" while it is unset.
 	BlocklistURLs      []string
 	ASNLimitPercentURL string
 	// CrowdSecDecisionsURL is the CrowdSec decision list, "" while
-	// SWW_CROWDSEC_LAPI_URL is unset, fetched with CrowdSecKey
-	// (SWW_CROWDSEC_LAPI_KEY).
+	// SWW_WAF_CROWDSEC_LAPI_URL is unset, fetched with CrowdSecKey
+	// (SWW_WAF_CROWDSEC_LAPI_KEY).
 	CrowdSecDecisionsURL string
 	CrowdSecKey          string
 	// Refresh is how long after a list was last fetched or tried it is
-	// fetched again (SWW_BLOCKLIST_REFRESH), but for the CrowdSec decision
+	// fetched again (SWW_WAF_BLOCKLIST_REFRESH), but for the CrowdSec decision
 	// list, which is fetched again crowdSecRefresh after.
 	Refresh time.Duration
 	// Now tells the time, normally time.Now in UTC.
@@ -152,7 +152,7 @@ func New(params Params) *Lists {
 }
 
 // URLs returns the URL of every list: the blocklists' in the order
-// SWW_BLOCKLIST_URLS names them, then SWW_ASN_LIMIT_PERCENT_URL, then
+// SWW_WAF_BLOCKLIST_URLS names them, then SWW_WAF_ASN_LIMIT_PERCENT_URL, then
 // the CrowdSec decision list's.
 func (l *Lists) URLs() []string {
 	urls := slices.Clone(l.params.BlocklistURLs)
@@ -168,7 +168,7 @@ func (l *Lists) URLs() []string {
 }
 
 // ListedBy returns the URLs of the blocklists whose copy lists addr, in
-// the order SWW_BLOCKLIST_URLS names them.
+// the order SWW_WAF_BLOCKLIST_URLS names them.
 func (l *Lists) ListedBy(addr netip.Addr) []string {
 	l.mu.Lock()
 	defer l.mu.Unlock()
@@ -551,7 +551,7 @@ func parseNetblock(text string) (netip.Prefix, bool) {
 }
 
 // parsePercents reads the lines of the file of AS:percent lines, each an
-// AS number, : and a percentage, as SWW_ASN_LIMIT_PERCENT takes them. An
+// AS number, : and a percentage, as SWW_WAF_ASN_LIMIT_PERCENT takes them. An
 // AS number listed more than once gets the lowest of its percentages.
 func parsePercents(lines []string) (entries, error) {
 	found := entries{percents: map[string]int64{}}