Caches of outside APIs live in /var/cache/sww (closes #314)

Every cache of answers from an outside service has its own file in `SWW_CACHE_DIR` (default `/var/cache/sww`): `lookups.json` (GeoJS), `lists.json` (lists fetched by URL, CrowdSec's decisions included), `dnsbl.json`, `abuseipdb-scores.json` and `routewatch.json` (at most 100,000 answers, each kept an hour). `reputation.json` is gone; the AbuseIPDB checks spent today stay in `SWW_STATE_DIR` as `abuseipdb-checks-spent.json`, since losing them would spend the daily budget twice.

A cache file never stops the start: one that does not parse is set aside as `<name>.bad` with a `file_error` alert. An unwritable `SWW_CACHE_DIR` stops the start. The `run` script creates the cache directory and gives it to `sww`. The cache directory needs no volume and can be left out of backups.

Model: opus-5-5

internal/config/config_test.go

@@ -74,6 +74,7 @@ const (
 	stateDir             = "SWW_STATE_DIR"
 	stateWriteDelay      = "SWW_STATE_WRITE_DELAY"
 	stateCounterInterval = "SWW_STATE_COUNTER_INTERVAL"
+	cacheDir             = "SWW_CACHE_DIR"
 	adminToken           = "SWW_ADMIN_TOKEN"   //nolint:gosec // the setting's name
 	metricsToken         = "SWW_METRICS_TOKEN" //nolint:gosec // the setting's name
 	metricsTopN          = "SWW_METRICS_TOP_N"
@@ -262,6 +263,7 @@ func TestDefaults(t *testing.T) {
 		StateDir:             "/var/lib/sww",
 		StateWriteDelay:      10 * time.Second,
 		StateCounterInterval: 15 * time.Minute,
+		CacheDir:             "/var/cache/sww",
 		MetricsToken:         "",
 		MetricsTopN:          50,
 		RulesDir:             "/etc/sww/rules.d",
@@ -346,6 +348,7 @@ func TestValuesAsSet(t *testing.T) {
 		stateDir:             "/srv/waf-state",
 		stateWriteDelay:      "500ms",
 		stateCounterInterval: "1h",
+		cacheDir:             "/srv/waf-cache",
 		metricsToken:         token,
 		metricsTopN:          "10",
 		rulesDir:             "/srv/waf-rules",
@@ -368,6 +371,7 @@ func TestValuesAsSet(t *testing.T) {
 		StateDir:             "/srv/waf-state",
 		StateWriteDelay:      500 * time.Millisecond,
 		StateCounterInterval: time.Hour,
+		CacheDir:             "/srv/waf-cache",
 		MetricsToken:         token,
 		MetricsTopN:          10,
 		RulesDir:             "/srv/waf-rules",
@@ -2302,6 +2306,7 @@ func TestInvalidBanOrStateValueStopsTheStart(t *testing.T) {
 		{stateDir, ""}, {stateDir, "state"}, {stateDir, "./var/lib/sww"},
 		{stateWriteDelay, off}, {stateWriteDelay, "0s"},
 		{stateCounterInterval, off}, {stateCounterInterval, "15"},
+		{cacheDir, ""}, {cacheDir, "cache"}, {cacheDir, "./var/cache/sww"},
 	})
 }
 
@@ -2574,6 +2579,7 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		stateDir:             "/var/lib/sww",
 		stateWriteDelay:      "10s",
 		stateCounterInterval: "15m",
+		cacheDir:             "/var/cache/sww",
 		adminToken:           "",
 		metricsToken:         "",
 		metricsTopN:          "50",
@@ -2674,8 +2680,8 @@ func wantLookupSettings(t *testing.T, got *config.Config, want config.Config) {
 	}
 }
 
-// wantBanSettings checks the settings for bans, the state files, the
-// metrics and the rule files.
+// wantBanSettings checks the settings for bans, the state and cache
+// files, the metrics and the rule files.
 func wantBanSettings(t *testing.T, got *config.Config, want config.Config) {
 	t.Helper()
 
@@ -2694,11 +2700,7 @@ func wantBanSettings(t *testing.T, got *config.Config, want config.Config) {
 			got.RulesDir, got.RulesEnabled, want.RulesDir, want.RulesEnabled)
 	}
 
-	if got.StateDir != want.StateDir ||
-		got.StateWriteDelay != want.StateWriteDelay ||
-		got.StateCounterInterval != want.StateCounterInterval {
-		t.Errorf("state settings\n%+v\nwant\n%+v", got, want)
-	}
+	wantStateSettings(t, got, want)
 
 	if got.MetricsToken != want.MetricsToken || got.MetricsTopN != want.MetricsTopN {
 		t.Errorf("metrics token %q and top %d, want %q and %d",
@@ -2706,6 +2708,18 @@ func wantBanSettings(t *testing.T, got *config.Config, want config.Config) {
 	}
 }
 
+// wantStateSettings checks the settings for the state and cache files.
+func wantStateSettings(t *testing.T, got *config.Config, want config.Config) {
+	t.Helper()
+
+	if got.StateDir != want.StateDir ||
+		got.StateWriteDelay != want.StateWriteDelay ||
+		got.StateCounterInterval != want.StateCounterInterval ||
+		got.CacheDir != want.CacheDir {
+		t.Errorf("state settings\n%+v\nwant\n%+v", got, want)
+	}
+}
+
 // wantNetblocks checks a list of netblocks.
 func wantNetblocks(t *testing.T, got []netip.Prefix, want ...string) {
 	t.Helper()