Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/alerts/alerts.go

@@ -44,10 +44,10 @@ const (
 	// EventAnomaly is a count of requests or bytes over an anomaly
 	// threshold.
 	EventAnomaly = "anomaly"
-	// EventWAFBlock is a request the Core Rule Set scored at or over
+	// EventCoreRuleSetMatch is a request the Core Rule Set scored at or over
 	// SWW_WAF_ANOMALY_THRESHOLD, refused in block mode, let through in
 	// detect mode.
-	EventWAFBlock = "waf_block"
+	EventCoreRuleSetMatch = "core_rule_set_match"
 	// EventReputationHit is a request whose client a blocklist, the
 	// CrowdSec decision list or a DNSBL zone lists, or whose AbuseIPDB score
 	// is a hit.
@@ -72,7 +72,7 @@ const (
 // default.
 func Events() []string {
 	return []string{
-		EventBan, EventPermanentBan, EventWAFBlock, EventAnomaly,
+		EventBan, EventPermanentBan, EventCoreRuleSetMatch, EventAnomaly,
 		EventReputationHit, EventSourceFailure, EventFileError,
 	}
 }
@@ -220,7 +220,7 @@ type State struct {
 // requests to it failed, and how many alerts were dropped from its full
 // queue or given up as it refused them.
 type Counts struct {
-	Sent, Failed, Dropped int64
+	Sent, SendFailures, Dropped int64
 }
 
 // Queue takes the alerts raised, holds back those it must, and sends the
@@ -264,7 +264,7 @@ type destination struct {
 	// waiting are the alerts waiting to be sent, oldest first.
 	waiting []*Alert
 
-	sent, failed, dropped atomic.Int64
+	sent, sendFailures, dropped atomic.Int64
 }
 
 // cooldownKey is what makes an alert a repeat of another: the same event
@@ -426,7 +426,9 @@ func (q *Queue) Counts(name string) Counts {
 	for _, d := range q.destinations {
 		if d.name == name {
 			return Counts{
-				Sent: d.sent.Load(), Failed: d.failed.Load(), Dropped: d.dropped.Load(),
+				Sent:         d.sent.Load(),
+				SendFailures: d.sendFailures.Load(),
+				Dropped:      d.dropped.Load(),
 			}
 		}
 	}
@@ -675,7 +677,7 @@ func (d *destination) run(ctx context.Context) {
 				retryAt = time.Time{}
 			case errors.Is(err, errRefused):
 				d.remove(alert)
-				d.failed.Add(1)
+				d.sendFailures.Add(1)
 				d.dropped.Add(1)
 
 				retryDelay = 0
@@ -684,7 +686,7 @@ func (d *destination) run(ctx context.Context) {
 				d.processLog.Warn("gave up an alert "+d.setting+" refused",
 					"event", alert.Event, "error", err.Error())
 			case ctx.Err() == nil: // not cut off as sww stops
-				d.failed.Add(1)
+				d.sendFailures.Add(1)
 
 				retryDelay = min(max(retryDelayFactor*retryDelay, firstRetryDelay),
 					maxRetryDelay)
@@ -871,7 +873,7 @@ func ntfyPriority(event string) string {
 		return "high"
 	case EventReputationHit:
 		return "low"
-	default: // ban, waf_block and summary
+	default: // ban, core_rule_set_match and summary
 		return "default"
 	}
 }
@@ -882,7 +884,7 @@ func ntfyTag(event string) string {
 	switch event {
 	case EventBan, EventPermanentBan:
 		return "no_entry"
-	case EventWAFBlock:
+	case EventCoreRuleSetMatch:
 		return "shield"
 	case EventAnomaly:
 		return "chart_with_upwards_trend"