rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

internal/config/rproxy.go

@@ -64,15 +64,9 @@ var (
 // invalid is an error that names it. Since rproxy never touches disk, its
 // settings have no _FILE form.
 func RProxyFromEnvironment(lookupEnv func(string) (string, bool)) (*RProxy, error) {
-	env := &environment{lookupEnv: func(name string) (string, bool) {
-		if strings.HasSuffix(name, "_FILE") {
-			return "", false
-		}
-
-		return lookupEnv(name)
-	}}
+	env := &environment{lookupEnv: withoutFileForms(lookupEnv)}
 	cfg := &RProxy{
-		ListenAddr:         env.address("SWRP_LISTEN_ADDR", defaultListenAddr),
+		ListenAddr:         env.address("SWRP_LISTEN_ADDR"),
 		UpstreamURL:        env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL),
 		TrustedProxies:     env.netblocks("SWRP_TRUSTED_PROXIES", privateRanges),
 		WAFBackend:         env.wafBackend("SWRP_WAF_BACKEND"),
@@ -93,6 +87,37 @@ func RProxyFromEnvironment(lookupEnv func(string) (string, bool)) (*RProxy, erro
 	return cfg, nil
 }
 
+// RProxyListenAddrAndUpstreamURL reads only SWRP_LISTEN_ADDR and
+// SWRP_UPSTREAM_URL. The health check in rproxy's container needs no other
+// setting, so it reads no other.
+func RProxyListenAddrAndUpstreamURL(
+	lookupEnv func(string) (string, bool),
+) (string, *url.URL, error) {
+	env := &environment{lookupEnv: withoutFileForms(lookupEnv)}
+	listenAddr := env.address("SWRP_LISTEN_ADDR")
+	upstreamURL := env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL)
+
+	if env.err != nil {
+		return "", nil, env.err
+	}
+
+	return listenAddr, upstreamURL, nil
+}
+
+// withoutFileForms returns lookupEnv finding no setting named with _FILE, since
+// rproxy never touches disk.
+func withoutFileForms(
+	lookupEnv func(string) (string, bool),
+) func(string) (string, bool) {
+	return func(name string) (string, bool) {
+		if strings.HasSuffix(name, "_FILE") {
+			return "", false
+		}
+
+		return lookupEnv(name)
+	}
+}
+
 // LogValue makes an RProxy log as each setting's name with the value it was
 // given, or its default.
 func (c *RProxy) LogValue() slog.Value {