Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

internal/sww/sww.go

@@ -20,6 +20,8 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/spf13/viper"
+
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/discriminator"
@@ -38,7 +40,7 @@ import (
 const shutdownTimeout = 5 * time.Second
 
 // remoteLogStopTimeout is how long, as discriminator stops, the log lines still
-// waiting are sent to SWW_LOG_REMOTE_URL before they are given up. stdout has
+// waiting are sent to SWW_WAF_LOG_REMOTE_URL before they are given up. stdout has
 // carried them.
 const remoteLogStopTimeout = 2 * time.Second
 
@@ -59,8 +61,9 @@ commands:
 type Params struct {
 	// Version is the version of the binary, set when it is built.
 	Version string
-	// LookupEnv reads an environment variable, normally os.LookupEnv.
-	LookupEnv func(string) (string, bool)
+	// Viper reads the settings, normally the viper config.NewViper returns
+	// for the process's environment.
+	Viper *viper.Viper
 	// Stdout receives the request log and the process's own messages.
 	Stdout io.Writer
 }
@@ -79,7 +82,7 @@ func Main(version string) int {
 		syscall.SIGTERM, os.Interrupt)
 	defer stop()
 
-	params := Params{Version: version, LookupEnv: os.LookupEnv, Stdout: os.Stdout}
+	params := Params{Version: version, Viper: config.NewViper(), Stdout: os.Stdout}
 
 	switch args[0] {
 	case "rproxy":
@@ -87,7 +90,7 @@ func Main(version string) int {
 	case "discriminator":
 		return RunDiscriminator(ctx, params)
 	case "healthcheck":
-		return HealthCheck(ctx, args[1:], os.LookupEnv, os.Stderr)
+		return HealthCheck(ctx, args[1:], params.Viper, os.Stderr)
 	default:
 		return printUsage(os.Stderr)
 	}
@@ -105,18 +108,18 @@ func printUsage(w io.Writer) int {
 // done. It returns the process's exit status, 1 when discriminator cannot start.
 func RunDiscriminator(ctx context.Context, params Params) int {
 	// Until the settings are read, the one message is an invalid setting's
-	// error, which every SWW_LOG_LEVEL lets through.
+	// error, which every SWW_WAF_LOG_LEVEL lets through.
 	processLog := requestlog.NewProcessLogger(params.Stdout,
-		config.InstanceName(params.LookupEnv), slog.LevelError)
+		config.InstanceName(params.Viper), slog.LevelError)
 
-	cfg, err := config.FromEnvironment(params.LookupEnv)
+	cfg, err := config.FromEnvironment(params.Viper)
 	if err != nil {
 		processLog.Error("invalid setting", "error", err.Error())
 
 		return 1
 	}
 
-	// While SWW_LOG_REMOTE_URL is set, every line on stdout from here on
+	// While SWW_WAF_LOG_REMOTE_URL is set, every line on stdout from here on
 	// is sent there too.
 	stdout := params.Stdout
 
@@ -178,7 +181,7 @@ func RunDiscriminator(ctx context.Context, params Params) int {
 
 	listener, err := (&net.ListenConfig{}).Listen(ctx, "tcp", cfg.ListenAddr)
 	if err != nil {
-		processLog.Error("cannot listen on SWW_LISTEN_ADDR", "error", err.Error())
+		processLog.Error("cannot listen on SWW_WAF_LISTEN_ADDR", "error", err.Error())
 
 		return 1
 	}
@@ -192,7 +195,7 @@ func RunDiscriminator(ctx context.Context, params Params) int {
 }
 
 // newServer returns the server discriminator runs, with the metrics of the alerts,
-// after reading the lookup database while SWW_LOOKUP_SOURCE is file. A lookup
+// after reading the lookup database while SWW_WAF_LOOKUP_SOURCE is file. A lookup
 // database that cannot be read is an error.
 func newServer(
 	cfg *config.Config, stdout io.Writer, processLog *slog.Logger,
@@ -281,7 +284,7 @@ func newAlertQueue(
 }
 
 // newRemoteLogSender returns a sender of the log lines to
-// SWW_LOG_REMOTE_URL, with the settings for it.
+// SWW_WAF_LOG_REMOTE_URL, with the settings for it.
 func newRemoteLogSender(cfg *config.Config) *remotelog.Sender {
 	return remotelog.New(remotelog.Params{
 		URL:      cfg.LogRemoteURL,