Caches of outside APIs live in /var/cache/sww (closes #314)

Every cache of answers from an outside service has its own file in `SWW_CACHE_DIR` (default `/var/cache/sww`): `lookups.json` (GeoJS), `lists.json` (lists fetched by URL, CrowdSec's decisions included), `dnsbl.json`, `abuseipdb-scores.json` and `routewatch.json` (at most 100,000 answers, each kept an hour). `reputation.json` is gone; the AbuseIPDB checks spent today stay in `SWW_STATE_DIR` as `abuseipdb-checks-spent.json`, since losing them would spend the daily budget twice.

A cache file never stops the start: one that does not parse is set aside as `<name>.bad` with a `file_error` alert. An unwritable `SWW_CACHE_DIR` stops the start. The `run` script creates the cache directory and gives it to `sww`. The cache directory needs no volume and can be left out of backups.

Model: opus-5-5

internal/reputation/abuseipdb.go

@@ -36,22 +36,21 @@ var (
 		"checks spent; none is made until the day ends at 00:00 UTC")
 )
 
-// Score is what AbuseIPDB said about a client, as reputation.json holds
-// it: the client, an IPv4 address or an IPv6 group, its abuse confidence
-// score, from 0 to 100, and when AbuseIPDB answered.
+// Score is what AbuseIPDB said about a client, as abuseipdb-scores.json
+// holds it: the client, an IPv4 address or an IPv6 group, its abuse
+// confidence score, from 0 to 100, and when AbuseIPDB answered.
 type Score struct {
 	Client  netip.Prefix `json:"client"`
 	Score   int64        `json:"score"`
 	Fetched time.Time    `json:"fetched"`
 }
 
-// Checks are what reputation.json keeps of the checks of clients with
-// AbuseIPDB: the day, in UTC, of the checks Spent counts, zero before the
-// first, and the scores still in use.
-type Checks struct {
-	Day    civil.Date `json:"day,omitzero"`
-	Spent  int        `json:"spent"`
-	Scores []Score    `json:"scores"`
+// ChecksSpent is what abuseipdb-checks-spent.json keeps of the checks of
+// clients with AbuseIPDB: the day, in UTC, of the checks Spent counts,
+// zero before the first.
+type ChecksSpent struct {
+	Day   civil.Date
+	Spent int
 }
 
 // AbuseIPDBParams are what NewAbuseIPDB needs.
@@ -196,35 +195,35 @@ func (a *AbuseIPDB) BudgetLeft() int {
 	return max(a.params.DailyBudget-a.spent, 0)
 }
 
-// Snapshot returns the checks spent and every score still in use, sorted
-// by client, as reputation.json keeps them.
-func (a *AbuseIPDB) Snapshot() Checks {
+// Snapshot returns every score still in use, sorted by client, as
+// abuseipdb-scores.json keeps them.
+func (a *AbuseIPDB) Snapshot() []Score {
 	a.mu.Lock()
 
 	now := a.params.Now()
-	checks := Checks{Day: a.day, Spent: a.spent, Scores: make([]Score, 0, a.scores.Len())}
+	scores := make([]Score, 0, a.scores.Len())
 
 	for _, kept := range a.scores.Values() {
 		if now.Sub(kept.Fetched) < a.params.CacheTTL {
-			checks.Scores = append(checks.Scores, kept)
+			scores = append(scores, kept)
 		}
 	}
 
 	a.mu.Unlock()
 
-	slices.SortFunc(checks.Scores, func(x, y Score) int {
+	slices.SortFunc(scores, func(x, y Score) int {
 		return x.Client.Compare(y.Client)
 	})
 
-	return checks
+	return scores
 }
 
-// Load keeps checks, read from reputation.json, in place of those it
-// keeps, but for the scores past maxVerdicts, those fetched longest ago.
-// One fetched CacheTTL ago or more is neither used nor written, as for any
-// score.
-func (a *AbuseIPDB) Load(checks Checks) {
-	scores := slices.Clone(checks.Scores)
+// Load keeps scores, read from abuseipdb-scores.json, in place of those
+// it keeps, but for the scores past maxVerdicts, those fetched longest
+// ago. One fetched CacheTTL ago or more is neither used nor written, as
+// for any score.
+func (a *AbuseIPDB) Load(scores []Score) {
+	scores = slices.Clone(scores)
 	slices.SortStableFunc(scores, func(x, y Score) int {
 		return x.Fetched.Compare(y.Fetched)
 	})
@@ -232,7 +231,6 @@ func (a *AbuseIPDB) Load(checks Checks) {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 
-	a.day, a.spent = checks.Day, checks.Spent
 	a.scores.Purge()
 
 	for _, kept := range scores {
@@ -240,6 +238,24 @@ func (a *AbuseIPDB) Load(checks Checks) {
 	}
 }
 
+// ChecksSpent returns the checks spent, as abuseipdb-checks-spent.json
+// keeps them.
+func (a *AbuseIPDB) ChecksSpent() ChecksSpent {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	return ChecksSpent{Day: a.day, Spent: a.spent}
+}
+
+// LoadChecksSpent keeps checks, read from abuseipdb-checks-spent.json, in
+// place of the checks spent.
+func (a *AbuseIPDB) LoadChecksSpent(checks ChecksSpent) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	a.day, a.spent = checks.Day, checks.Spent
+}
+
 // check checks client with AbuseIPDB by addr, one of its addresses, keeps
 // the score as client's, and notes the check as no longer under way. A
 // check that fails gives no score: it is counted, logged and raised as a