Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/alerts/alerts_test.go

@@ -165,7 +165,7 @@ func TestWouldSendOnlyForTheChosenEvents(t *testing.T) {
 	if q.WouldSend(alerts.EventBan, netblock(1)) ||
 		q.WouldSend(alerts.EventPermanentBan, netblock(1)) {
 		t.Error(
-			"a ban alert would be sent, though SWW_ALERT_EVENTS leaves it out",
+			"a ban alert would be sent, though SWW_WAF_ALERT_EVENTS leaves it out",
 		)
 	}
 
@@ -218,8 +218,8 @@ func TestWouldSendWithOnlySlackOrOnlyNtfySet(t *testing.T) {
 	onlyNtfy.NtfyURL = parseURL(ntfyURL)
 
 	for setting, params := range map[string]alerts.Params{
-		"SWW_ALERT_SLACK_WEBHOOK_URL": onlySlack,
-		"SWW_ALERT_NTFY_URL":          onlyNtfy,
+		"SWW_WAF_ALERT_SLACK_WEBHOOK_URL": onlySlack,
+		"SWW_WAF_ALERT_NTFY_URL":          onlyNtfy,
 	} {
 		if !alerts.New(params).WouldSend(alerts.EventBan, netblock(1)) {
 			t.Errorf(
@@ -431,7 +431,7 @@ func TestAlertsPastTheHourlyLimitAreRolledIntoOneSummary(t *testing.T) {
 			"as_name":  "",
 			"country":  "",
 			"reason": "3 alerts held back in the hour from 2000-01-01T00:00:00Z, " +
-				"past the 2 an hour SWW_ALERT_MAX_PER_HOUR allows",
+				"past the 2 an hour SWW_WAF_ALERT_MAX_PER_HOUR allows",
 			"detail": map[string]any{
 				"hour":  started,
 				"count": float64(3),
@@ -631,7 +631,7 @@ func TestFailedRequestIsSentAgainWithBackoff(t *testing.T) {
 		wantCounts(t, q, 0, int64(len(want)), 0, 0)
 
 		if !strings.Contains(log.String(),
-			`"msg":"sending an alert to SWW_ALERT_WEBHOOK_URL failed"`) {
+			`"msg":"sending an alert to SWW_WAF_ALERT_WEBHOOK_URL failed"`) {
 			t.Errorf("process log %q names no failure", log.String())
 		}
 
@@ -701,7 +701,7 @@ func TestRefusedAlertIsGivenUpAndTheNextSent(t *testing.T) {
 		wantCounts(t, q, 1, 3, 0, 1)
 
 		if !strings.Contains(log.String(),
-			`"msg":"gave up an alert SWW_ALERT_WEBHOOK_URL refused"`) {
+			`"msg":"gave up an alert SWW_WAF_ALERT_WEBHOOK_URL refused"`) {
 			t.Errorf("process log %q names no alert given up", log.String())
 		}
 	})
@@ -724,8 +724,10 @@ func TestFailedRequestIsLoggedWithoutTheURL(t *testing.T) {
 		synctest.Wait()
 
 		logged := log.String()
-		if !strings.Contains(logged,
-			`"msg":"sending an alert to SWW_ALERT_WEBHOOK_URL failed"`) ||
+		if !strings.Contains(
+			logged,
+			`"msg":"sending an alert to SWW_WAF_ALERT_WEBHOOK_URL failed"`,
+		) ||
 			strings.Contains(
 				logged,
 				"alerts.example",
@@ -937,8 +939,8 @@ func TestSlackAndNtfyAreSentTheSummaryAndTheRepeatsHeldBack(t *testing.T) {
 		}
 
 		const summary = "1 alerts held back in the hour from 2000-01-01T00:00:00Z, " +
-			"past the 1 an hour SWW_ALERT_MAX_PER_HOUR allows; 1 repeats held back " +
-			"by SWW_ALERT_COOLDOWN that no later alert gives\nsuppressed repeats: 1"
+			"past the 1 an hour SWW_WAF_ALERT_MAX_PER_HOUR allows; 1 repeats held back " +
+			"by SWW_WAF_ALERT_COOLDOWN that no later alert gives\nsuppressed repeats: 1"
 
 		wantSlackMessage(t, slack[1], "*"+instance+": summary*\n"+summary)
 		wantNtfyMessage(
@@ -1088,7 +1090,7 @@ func TestDestinationThatDoesNotAnswerHoldsUpNeitherOther(t *testing.T) {
 		logged := log.String()
 		if !strings.Contains(
 			logged,
-			`"msg":"sending an alert to SWW_ALERT_SLACK_WEBHOOK_URL failed"`,
+			`"msg":"sending an alert to SWW_WAF_ALERT_SLACK_WEBHOOK_URL failed"`,
 		) ||
 			strings.Contains(logged, "hooks.slack.example") ||
 			strings.Contains(logged, "T0123") {
@@ -1462,7 +1464,7 @@ type eventMessage struct {
 	title, priorityAndTag, text string
 }
 
-// anAlertForEachEvent returns an alert for each event SWW_ALERT_EVENTS
+// anAlertForEachEvent returns an alert for each event SWW_WAF_ALERT_EVENTS
 // names, the first in observe mode, each with its message.
 func anAlertForEachEvent() []eventMessage {
 	return []eventMessage{