Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/discriminator/admin_test.go

@@ -17,8 +17,8 @@ import (
 )
 
 const (
-	adminToken = "SWW_ADMIN_TOKEN" //nolint:gosec // the setting's name
-	// adminSecret is the SWW_ADMIN_TOKEN the tests set, and adminBearer
+	adminToken = "SWW_WAF_ADMIN_TOKEN" //nolint:gosec // the setting's name
+	// adminSecret is the SWW_WAF_ADMIN_TOKEN the tests set, and adminBearer
 	// how a request carries it.
 	adminSecret = "fedcba9876543210fedcba9876543210"
 	adminBearer = "Bearer " + adminSecret
@@ -337,12 +337,12 @@ func TestAdminEndpointsNeedTheTokenInObserveMode(t *testing.T) {
 	}
 }
 
-// adminEndpoint is a request to an endpoint SWW_ADMIN_TOKEN opens.
+// adminEndpoint is a request to an endpoint SWW_WAF_ADMIN_TOKEN opens.
 type adminEndpoint struct {
 	method, path, body string
 }
 
-// adminEndpoints returns a request to each endpoint SWW_ADMIN_TOKEN
+// adminEndpoints returns a request to each endpoint SWW_WAF_ADMIN_TOKEN
 // opens: listing the bans, banning otherClient for an hour, lifting the
 // bans on otherClient, and asking about otherClient.
 func adminEndpoints() []adminEndpoint {