Settle the spec's open points after milestones 1 and 2 (closes #36)

The header size and the idle time stay fixed at their defaults through
milestone 2 and become settings in the first stage after it, which also
brings SWWAF_ALLOW_NETS and with it the allow-only country list's refusal
of private addresses. While a request body is on its way, a request
timeout answers 408 or 504 by the side smallwebwaf was waiting on, as
milestone 1's code does. The README says the state files, the GeoJS
answers among them, come in milestone 3 or later, and points at the
build order.

Model: opus-5-5

README.md

@@ -230,7 +230,10 @@ goes through the candidates one by one.
   answers, the reputation cache, the alerting state) held in memory and kept in
   readable JSON files, written regularly and at every stop, so a restart loses
   nothing. Edit a file, or add a rule file, and the running `smallwebwaf` picks
-  up the change. Nothing is read from disk while serving a request.
+  up the change. Nothing is read from disk while serving a request. The files
+  come in milestone 3 or later (see the build order in [`SPEC.md`](SPEC.md));
+  until then the rate counters and the GeoJS answers are kept in memory only,
+  and a restart loses them.
 - Health checks, the metrics, and listing, adding and lifting bans or asking why
   a given address was refused, all on the one port every request uses: under
   `/_smallwebwaf/` on the app's own address, through traefik like any other
@@ -349,9 +352,10 @@ GeoJS web service, which needs no account and no file. This means that, by
 default, the address of every new visitor is sent to GeoJS. Each answer is kept
 in memory for seven days, and many addresses are asked about in one request;
 writing the answers to disk, so that they survive a restart, comes in milestone
-3 or later. GeoJS publishes no rate limit but may block a caller it thinks asks
-too much; while it is not answering, new visitors count as coming from an
-unknown country, which `SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES` refuses.
+3 or later (see the build order in [`SPEC.md`](SPEC.md)). GeoJS publishes no
+rate limit but may block a caller it thinks asks too much; while it is not
+answering, new visitors count as coming from an unknown country, which
+`SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES` refuses.
 
 To keep your visitors' addresses on your own host, set
 `SWWAF_LOOKUP_SOURCE=off`, or use the database file instead of GeoJS:
@@ -373,7 +377,9 @@ that link.
 Neither source can place a private address, so a client on one, such as a
 visitor on your local network, another container or your monitoring, has no
 country: `SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES` refuses it unless you list it in
-`SWWAF_ALLOW_NETS`. Such addresses are never sent to GeoJS.
+`SWWAF_ALLOW_NETS`. Such addresses are never sent to GeoJS. In milestone 2,
+which has no `SWWAF_ALLOW_NETS`, neither country list checks such a client; the
+refusal comes with `SWWAF_ALLOW_NETS` in milestone 3 or later.
 
 ## How the code is laid out