Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

internal/state/state.go

@@ -1,5 +1,5 @@
 // Package state keeps sww's state in JSON files in
-// SWW_STATE_DIR, as the "Persistent state" section of SPEC.md requires
+// SWW_WAF_STATE_DIR, as the "Persistent state" section of SPEC.md requires
 // and docs/state-files.md lists them:
 // bans.json holds the bans, clients.json each client's counters and
 // history, lookups.json GeoJS's answers, reputation.json the last try and
@@ -72,11 +72,11 @@ var (
 
 // Params are what Load needs.
 type Params struct {
-	// Dir is the directory of the state files (SWW_STATE_DIR).
+	// Dir is the directory of the state files (SWW_WAF_STATE_DIR).
 	Dir string
 	// WriteDelay is how long after a ban is made bans.json is written
-	// (SWW_STATE_WRITE_DELAY), and CounterInterval how often every file
-	// is (SWW_STATE_COUNTER_INTERVAL).
+	// (SWW_WAF_STATE_WRITE_DELAY), and CounterInterval how often every file
+	// is (SWW_WAF_STATE_COUNTER_INTERVAL).
 	WriteDelay      time.Duration
 	CounterInterval time.Duration
 	// Ledger, Limiter, GeoJS, Lists, DNSBL, AbuseIPDB, Alerts and Anomalies
@@ -185,7 +185,7 @@ type stateFile interface {
 func Load(params Params) (*Files, error) {
 	err := checkWritable(params.Dir)
 	if err != nil {
-		return nil, fmt.Errorf("SWW_STATE_DIR cannot be written: %w", err)
+		return nil, fmt.Errorf("SWW_WAF_STATE_DIR cannot be written: %w", err)
 	}
 
 	f := &Files{params: params, sums: map[string][sha256.Size]byte{}}
@@ -362,7 +362,7 @@ func (f *Files) read(name string) (int, error) {
 func (f *Files) readChanged(name string) ([]byte, bool, error) {
 	path := filepath.Join(f.params.Dir, name)
 
-	data, err := os.ReadFile(path) //nolint:gosec // a state file, in SWW_STATE_DIR
+	data, err := os.ReadFile(path) //nolint:gosec // a state file, in SWW_WAF_STATE_DIR
 	if errors.Is(err, fs.ErrNotExist) {
 		return nil, false, nil
 	}
@@ -1035,7 +1035,7 @@ func write(dir, name string, data []byte) error {
 
 // syncDirectory syncs dir to the disk, so that a rename in it lasts.
 func syncDirectory(dir string) error {
-	directory, err := os.Open(dir) //nolint:gosec // SWW_STATE_DIR itself
+	directory, err := os.Open(dir) //nolint:gosec // SWW_WAF_STATE_DIR itself
 	if err != nil {
 		return err
 	}
@@ -1045,7 +1045,7 @@ func syncDirectory(dir string) error {
 
 // writeSynced writes data to the file at path, and syncs it to the disk.
 func writeSynced(path string, data []byte) error {
-	//nolint:gosec // a state file's temporary file, in SWW_STATE_DIR
+	//nolint:gosec // a state file's temporary file, in SWW_WAF_STATE_DIR
 	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, fileMode)
 	if err != nil {
 		return err

internal/state/state_test.go

@@ -931,7 +931,7 @@ func TestUnwritableDirectoryStopsTheStart(t *testing.T) {
 		filepath.Join(t.TempDir(), "missing"),
 		notADirectory,
 	} {
-		const want = "SWW_STATE_DIR cannot be written: "
+		const want = "SWW_WAF_STATE_DIR cannot be written: "
 
 		_, err := state.Load(newParams(dir))
 		if err == nil || !strings.HasPrefix(err.Error(), want) {