Anomaly thresholds: alerts for unusual traffic, nothing refused (closes #101)

SWWAF_ANOMALY_CLIENT_*, _NET_*, _ASN_*, _TOTAL_* and SWWAF_WATCH_* with
SWWAF_WATCH_NETS: requests and bytes per minute and per hour, each off by
default. Every request but the health check is counted, allow-listed and
exempt ones included, in the buckets the rate limits use; a count over its
threshold raises an anomaly alert, with a cooldown per scope. At most
20,000 counters, kept in alerts.json. A per-AS-number threshold with
lookups off, or a malformed SWWAF_WATCH_NETS, stops the start.

Judgement call: refused requests are counted too.
Judgement call: per-client counters are kept in alerts.json, which SPEC.md does not list.
Judgement call: a request counts for an AS number only if the lookup answered before it ended.

Model: opus-5-5

internal/proxy/biased_test.go

@@ -421,17 +421,28 @@ func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T
 	}
 }
 
-// startWithLookups is startAppWithAlerts in front of readAndAnswer, with
-// the settings in env on top of clients looked up in a lookup database,
-// which places fromDE and fromKP in the AS numbers and countries the
-// stand-in for GeoJS gives them, noCountry in AS64500 and no country, and
-// no other address. It returns the sender, the server and the queue of
-// the alerts.
+// startWithLookups is startWithLookupsAndClock for a test that needs no
+// clock.
 func startWithLookups(
 	t *testing.T, env map[string]string,
 ) (*sender, *proxy.Server, *alerts.Queue) {
 	t.Helper()
 
+	s, _, server, queue := startWithLookupsAndClock(t, env)
+
+	return s, server, queue
+}
+
+// startWithLookupsAndClock is startAppWithAlerts in front of
+// readAndAnswer, with the settings in env on top of clients looked up in a
+// lookup database, which places fromDE and fromKP in the AS numbers and
+// countries the stand-in for GeoJS gives them, noCountry in AS64500 and no
+// country, and no other address.
+func startWithLookupsAndClock(
+	t *testing.T, env map[string]string,
+) (*sender, *clock, *proxy.Server, *alerts.Queue) {
+	t.Helper()
+
 	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
 	lookuptest.Write(t, path, map[string]lookuptest.Network{
 		fromDE + "/32":    {ASN: asnDE, ASName: asNameDE, Country: "DE"},
@@ -442,9 +453,7 @@ func startWithLookups(
 	settings := map[string]string{lookupSource: fileSource, lookupDBPath: path}
 	maps.Copy(settings, env)
 
-	s, _, server, queue := startAppWithAlerts(t, readAndAnswer, settings)
-
-	return s, server, queue
+	return startAppWithAlerts(t, readAndAnswer, settings)
 }
 
 // uploadFrom is upload from the client at from.