Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/discriminator/bans_test.go

@@ -26,7 +26,7 @@ const (
 	userAgent = "ban-test/1.0"
 	// permanent is the log line's ban_expires for a permanent ban.
 	permanent = "permanent"
-	// banResponseClose is the SWW_BAN_RESPONSE that closes the connection.
+	// banResponseClose is the SWW_WAF_BAN_RESPONSE that closes the connection.
 	banResponseClose = "close"
 )
 
@@ -91,19 +91,19 @@ func TestBanLengthsFollowTheSettings(t *testing.T) {
 		}
 	}
 
-	// A first ban lasts SWW_LIMIT_BAN_DURATION; one within
-	// SWW_LIMIT_BAN_REPEAT_WINDOW after it ended, three times as long.
+	// A first ban lasts SWW_WAF_LIMIT_BAN_DURATION; one within
+	// SWW_WAF_LIMIT_BAN_REPEAT_WINDOW after it ended, three times as long.
 	wantExpires(breakLimit(), 10*time.Minute)
 	clk.advance(10*time.Minute + time.Hour)
 	wantExpires(breakLimit(), 30*time.Minute)
 
-	// Later than that, SWW_LIMIT_BAN_DURATION again.
+	// Later than that, SWW_WAF_LIMIT_BAN_DURATION again.
 	clk.advance(30*time.Minute + time.Hour + time.Second)
 	wantExpires(breakLimit(), 10*time.Minute)
 	clk.advance(10 * time.Minute)
 	wantExpires(breakLimit(), 30*time.Minute)
 
-	// 90 minutes would be longer than SWW_MAX_BAN_DURATION: the ban is
+	// 90 minutes would be longer than SWW_WAF_MAX_BAN_DURATION: the ban is
 	// permanent.
 	clk.advance(30 * time.Minute)
 
@@ -150,8 +150,8 @@ func TestBanCoversTheClientsNetblock(t *testing.T) {
 
 	// In the IPv4 cases, client breaks the limit; these two are next to it.
 	const (
-		allowed = "203.0.113.60" // in SWW_ALLOW_NETS
-		exempt  = "203.0.113.50" // in SWW_RATE_LIMIT_EXEMPT_NETS
+		allowed = "203.0.113.60" // in SWW_WAF_ALLOW_NETS
+		exempt  = "203.0.113.50" // in SWW_WAF_RATE_LIMIT_EXEMPT_NETS
 	)
 
 	for _, tc := range []struct {
@@ -166,7 +166,7 @@ func TestBanCoversTheClientsNetblock(t *testing.T) {
 			nil, []string{otherClient, exempt},
 		},
 		{
-			"the IPv4 netblock SWW_BAN_SCOPE_V4_PREFIX sets",
+			"the IPv4 netblock SWW_WAF_BAN_SCOPE_V4_PREFIX sets",
 			map[string]string{banScopeV4Prefix: "24"}, client,
 			[]string{otherClient, exempt}, []string{"203.0.112.9", allowed},
 		},
@@ -175,7 +175,7 @@ func TestBanCoversTheClientsNetblock(t *testing.T) {
 			[]string{"2001:db8:5::ffff:1"}, []string{"2001:db8:5:1::1"},
 		},
 		{
-			"the IPv6 netblock SWW_IPV6_GROUP_PREFIX sets",
+			"the IPv6 netblock SWW_WAF_IPV6_GROUP_PREFIX sets",
 			map[string]string{ipv6GroupPrefix: "48"}, "2001:db8:7::1",
 			[]string{"2001:db8:7:ffff::1"}, []string{"2001:db8:8::1"},
 		},
@@ -249,10 +249,10 @@ func TestRefusalUnderABanNamesItsHeuristicNetblockAndEnd(t *testing.T) {
 func TestBanResponseAnswersEveryRefusalButTheSizeLimits(t *testing.T) {
 	t.Parallel()
 
-	const denied = "192.0.2.50" // in SWW_DENY_NETS
+	const denied = "192.0.2.50" // in SWW_WAF_DENY_NETS
 
 	for _, tc := range []struct {
-		setting string // "" leaves SWW_BAN_RESPONSE at its default
+		setting string // "" leaves SWW_WAF_BAN_RESPONSE at its default
 		status  int    // 0 is the connection closed without an answer
 	}{
 		{"", http.StatusForbidden},