Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/discriminator/biased.go

@@ -17,9 +17,9 @@ type percentage struct {
 }
 
 // biasedThresholdsSet reports whether a biased threshold can lower a
-// client's limits by its lookup: SWW_ASN_BYTES_PERCENT or
-// SWW_COUNTRY_BYTES_PERCENT is not empty, SWW_UNKNOWN_LIMIT_PERCENT is
-// below 100, or SWW_ASN_LIMIT_PERCENT_URL is set. The client's lookup is
+// client's limits by its lookup: SWW_WAF_ASN_BYTES_PERCENT or
+// SWW_WAF_COUNTRY_BYTES_PERCENT is not empty, SWW_WAF_UNKNOWN_LIMIT_PERCENT is
+// below 100, or SWW_WAF_ASN_LIMIT_PERCENT_URL is set. The client's lookup is
 // then needed before its request goes on.
 func biasedThresholdsSet(cfg *config.Config) bool {
 	return len(cfg.ASNBytesPercent) > 0 || len(cfg.CountryBytesPercent) > 0 ||
@@ -31,15 +31,15 @@ func biasedThresholdsSet(cfg *config.Config) bool {
 // as looked up, each "" when unknown, and the blocklists, DNSBL zones and
 // AbuseIPDB that list it. Each is the lowest of those the settings give
 // it, the first of them in the order below when several are lowest: the
-// percentage SWW_TAG_LIMIT_PERCENT gives its asn= tag, the one the file
-// SWW_ASN_LIMIT_PERCENT_URL names gives its AS number, the one
-// SWW_TAG_LIMIT_PERCENT gives its country= tag, the lowest it gives its
+// percentage SWW_WAF_TAG_LIMIT_PERCENT gives its asn= tag, the one the file
+// SWW_WAF_ASN_LIMIT_PERCENT_URL names gives its AS number, the one
+// SWW_WAF_TAG_LIMIT_PERCENT gives its country= tag, the lowest it gives its
 // other tags, for a client without a country, unless its request skipped
-// the wait for GeoJS, SWW_UNKNOWN_LIMIT_PERCENT, for a client a blocklist
-// lists, the percentage of SWW_BLOCKLIST_ACTION while it is limit, and
+// the wait for GeoJS, SWW_WAF_UNKNOWN_LIMIT_PERCENT, for a client a blocklist
+// lists, the percentage of SWW_WAF_BLOCKLIST_ACTION while it is limit, and
 // for a client a DNSBL zone's verdict lists, or whose AbuseIPDB score is
-// a hit, the percentage of SWW_REPUTATION_ACTION while it is limit. For
-// the byte limits, SWW_ASN_BYTES_PERCENT and SWW_COUNTRY_BYTES_PERCENT
+// a hit, the percentage of SWW_WAF_REPUTATION_ACTION while it is limit. For
+// the byte limits, SWW_WAF_ASN_BYTES_PERCENT and SWW_WAF_COUNTRY_BYTES_PERCENT
 // take the place of the first three for an AS number or a country they
 // list.
 func (rq *request) limitPercentages() (percentage, percentage) {
@@ -48,25 +48,25 @@ func (rq *request) limitPercentages() (percentage, percentage) {
 
 	unknown := percentage{percent: whole}
 	if country == "" && !rq.skippedLookupWait {
-		unknown = percentage{cfg.UnknownLimitPercent, "SWW_UNKNOWN_LIMIT_PERCENT"}
+		unknown = percentage{cfg.UnknownLimitPercent, "SWW_WAF_UNKNOWN_LIMIT_PERCENT"}
 	}
 
 	fetched := percentage{percent: whole}
 	if percent, listed := rq.h.lists.ASNLimitPercent(asn); listed {
-		fetched = percentage{percent, "SWW_ASN_LIMIT_PERCENT_URL"}
+		fetched = percentage{percent, "SWW_WAF_ASN_LIMIT_PERCENT_URL"}
 	}
 
 	blocklisted := percentage{percent: whole}
 	if rq.blocklisted && cfg.BlocklistAction == "limit" {
-		blocklisted = percentage{cfg.BlocklistLimitPercent, "SWW_BLOCKLIST_ACTION"}
+		blocklisted = percentage{cfg.BlocklistLimitPercent, "SWW_WAF_BLOCKLIST_ACTION"}
 	}
 
 	reputationListed := percentage{percent: whole}
 	if (rq.dnsblListed || rq.abuseIPDBHit) && cfg.ReputationAction == "limit" {
-		reputationListed = percentage{cfg.ReputationLimitPercent, "SWW_REPUTATION_ACTION"}
+		reputationListed = percentage{cfg.ReputationLimitPercent, "SWW_WAF_REPUTATION_ACTION"}
 	}
 
-	const tagSetting = "SWW_TAG_LIMIT_PERCENT"
+	const tagSetting = "SWW_WAF_TAG_LIMIT_PERCENT"
 
 	asnRequests := lowest(given(cfg.TagLimitPercent, asnTag(asn), tagSetting), fetched)
 	countryRequests := given(cfg.TagLimitPercent, countryTag(country), tagSetting)
@@ -81,11 +81,12 @@ func (rq *request) limitPercentages() (percentage, percentage) {
 
 	asnBytes, countryBytes := asnRequests, countryRequests
 	if _, listed := cfg.ASNBytesPercent[asn]; listed {
-		asnBytes = given(cfg.ASNBytesPercent, asn, "SWW_ASN_BYTES_PERCENT")
+		asnBytes = given(cfg.ASNBytesPercent, asn, "SWW_WAF_ASN_BYTES_PERCENT")
 	}
 
 	if _, listed := cfg.CountryBytesPercent[country]; listed {
-		countryBytes = given(cfg.CountryBytesPercent, country, "SWW_COUNTRY_BYTES_PERCENT")
+		countryBytes = given(cfg.CountryBytesPercent, country,
+			"SWW_WAF_COUNTRY_BYTES_PERCENT")
 	}
 
 	return lowest(asnRequests, countryRequests, otherTags, unknown, blocklisted,