Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/requestlog/requestlog.go

@@ -43,17 +43,17 @@ const (
 	ActionBlockedByBlockRule = "blocked_by_block_rule"
 
 	// ActionBlockedByCoreRuleSet is a request refused because the Core Rule
-	// Set scored it at or over SWW_WAF_ANOMALY_THRESHOLD.
+	// Set scored it at or over SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD.
 	ActionBlockedByCoreRuleSet = "blocked_by_core_rule_set"
 
 	// ActionClientDenied is a request refused because its client is in
-	// SWW_DENY_NETS, in a blocklist while SWW_BLOCKLIST_ACTION is deny,
+	// SWW_WAF_DENY_NETS, in a blocklist while SWW_WAF_BLOCKLIST_ACTION is deny,
 	// or listed by a DNSBL zone, or scored a hit by AbuseIPDB, while
-	// SWW_REPUTATION_ACTION is deny, or that carries a tag in SWW_TAG_DENY.
+	// SWW_WAF_REPUTATION_ACTION is deny, or that carries a tag in SWW_WAF_TAG_DENY.
 	ActionClientDenied = "client_denied"
 
 	// ActionCountryDenied is a request refused because its client's country
-	// is not in SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.
+	// is not in SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES.
 	ActionCountryDenied = "country_denied"
 	// ActionOwnEndpoint is a request discriminator answered at one of its own
 	// endpoints, or a question about a path under /_sww/.
@@ -125,7 +125,7 @@ type Line struct {
 	ContentType  string `json:"content_type,omitempty"`
 	// ContentLength is the length of its body the request announced.
 	ContentLength int64 `json:"content_length,omitempty"`
-	// RequestHeaders are the headers SWW_LOG_REQUEST_HEADERS names that
+	// RequestHeaders are the headers SWW_WAF_LOG_REQUEST_HEADERS names that
 	// the request carried, by name in lower case.
 	RequestHeaders   map[string]string `json:"request_headers,omitempty"`
 	HasAuthorization bool              `json:"has_authorization,omitempty"`
@@ -188,7 +188,7 @@ type Line struct {
 	Reputation []string `json:"reputation,omitempty"`
 	// Tags are the request's tags, sorted.
 	Tags []string `json:"tags,omitempty"`
-	// RouteWatchTagsMissing, while SWW_ROUTEWATCH_URL is set, says why the
+	// RouteWatchTagsMissing, while SWW_WAF_ROUTEWATCH_URL is set, says why the
 	// request got no tags from routewatch: no_answer_yet, request_failed or
 	// no_route.
 	RouteWatchTagsMissing string `json:"routewatch_tags_missing,omitempty"`
@@ -232,7 +232,7 @@ type RProxyLine struct {
 	DurationRequestMS  float64 `json:"duration_request_ms"`
 	DurationResponseMS float64 `json:"duration_response_ms"`
 	// Disposition is the valid disposition discriminator answered or, while
-	// DefaultDisposition is true, the value of SWRP_DEFAULT_DISPOSITION. It is ""
+	// DefaultDisposition is true, the value of SWW_RPROXY_DEFAULT_DISPOSITION. It is ""
 	// when neither gave one.
 	Disposition        string `json:"disposition,omitempty"`
 	DefaultDisposition bool   `json:"default_disposition,omitempty"`
@@ -284,8 +284,8 @@ func Milliseconds(d time.Duration) float64 {
 
 // NewProcessLogger returns the logger for the process's own messages:
 // JSON lines on w, marked "type":"process", with the time in the same form
-// as a request line's, and instanceName, SWW_INSTANCE_NAME, as instance.
-// It writes only the messages at level, SWW_LOG_LEVEL, or more severe;
+// as a request line's, and instanceName, SWW_WAF_INSTANCE_NAME, as instance.
+// It writes only the messages at level, SWW_WAF_LOG_LEVEL, or more severe;
 // the request lines Write writes are never held back.
 func NewProcessLogger(
 	w io.Writer,