Name request log actions so they say what they mean (closes #229)

The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported.

Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent.
Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1.

Model: opus-5-5

internal/bans/admin_test.go

@@ -341,3 +341,48 @@ func TestLiftLiftsEveryActiveBanCoveringTheClient(t *testing.T) {
 
 	wantChanged(t, ledger, false)
 }
+
+func TestPermanentBanOnAWiderNetblockIsReturnedOverATemporaryBan(t *testing.T) {
+	t.Parallel()
+
+	client := netip.MustParseAddr("203.0.113.9")
+	ledger := bans.New(defaultRules())
+
+	// The temporary ban is made first, so that its netblock is looked at first.
+	ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"), midnight(), bans.Notes{})
+	ledger.BanForAdmin(netip.MustParsePrefix("203.0.113.0/24"), midnight(), time.Time{},
+		"for good")
+
+	wantPermanentBan(t, ledger, client, midnight().Add(time.Minute))
+}
+
+func TestOlderPermanentBanIsReturnedOverANewerTemporaryBan(t *testing.T) {
+	t.Parallel()
+
+	netblock := netip.MustParsePrefix("203.0.113.0/24")
+	ledger := bans.New(defaultRules())
+
+	ledger.BanForAdmin(netblock, midnight(), time.Time{}, "for good")
+	ledger.BanForAdmin(netblock, midnight().Add(time.Minute), midnight().Add(time.Hour),
+		"for an hour")
+
+	wantPermanentBan(t, ledger, netblock.Addr(), midnight().Add(2*time.Minute))
+}
+
+// wantPermanentBan checks that Find and Check return a permanent ban for
+// client at now.
+func wantPermanentBan(
+	t *testing.T, ledger *bans.Ledger, client netip.Addr, now time.Time,
+) {
+	t.Helper()
+
+	for name, look := range map[string]func(netip.Addr, time.Time) (bans.Ban, bool, bool){
+		"Find":  ledger.Find,
+		"Check": ledger.Check,
+	} {
+		ban, banned, _ := look(client, now)
+		if !banned || !ban.Permanent() {
+			t.Errorf("%s returned %+v and banned %v, want a permanent ban", name, ban, banned)
+		}
+	}
+}