The image creates SWW_STATE_DIR when it is missing (closes #337)

Before waf starts, share/sww.run makes SWW_STATE_DIR if it is missing,
gives it to sww:sww and sets its mode to 0700. A setting that is not an
absolute path, or a SWW_STATE_DIR_FILE that cannot be read, still
changes nothing. script/example-app now checks that a waf container
whose SWW_STATE_DIR does not exist becomes healthy with the directory
made for sww, mode 0700.

Model: opus-5-5

docs/image.md

@@ -19,7 +19,8 @@ way.
 - The service directory `/etc/service/sww`, with the `run` script
   `share/sww.run`.
 - `/var/lib/sww` for `waf`'s state files, and `/etc/sww/rules.d` with the
-  default rule file `share/rules.d/00-default.rules`.
+  default rule file `share/rules.d/00-default.rules`. The `run` script makes
+  `SWW_STATE_DIR` when it is missing.
 - `EXPOSE 8080`, and the `HEALTHCHECK` that runs `sww healthcheck`.
 
 ## Pins

docs/settings.md

@@ -53,7 +53,7 @@ the two (see "The image's command" below).
 ## State and cache files
 
 - `SWW_STATE_DIR` (default `/var/lib/sww`): the directory of the state files, an
-  absolute path that exists and can be written.
+  absolute path that can be written. The image's `run` script makes it.
 - `SWW_STATE_WRITE_DELAY` (default `10s`): how long `bans.json` waits to be
   written after a ban is made, lifted or made permanent. A duration.
 - `SWW_STATE_COUNTER_INTERVAL` (default `15m`): how often every state and cache