Name request log actions so they say what they mean (closes #229)

The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported.

Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent.
Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1.

Model: opus-5-5

internal/metrics/metrics.go

@@ -424,10 +424,10 @@ func (m *Metrics) LimitHit(hit ratelimit.Hit) {
 // them.
 func (m *Metrics) Offences(r ratelimit.Request) {
 	for kind, committed := range map[string]bool{
-		"limit":        r.BrokeLimit,
-		"attack":       r.Attack,
-		"rule_blocked": r.RuleBlocked,
-		"waf_blocked":  r.WAFBlocked,
+		"limit":                 r.BrokeLimit,
+		"attack":                r.Attack,
+		"blocked_by_block_rule": r.BlockedByBlockRule,
+		"waf_blocked":           r.WAFBlocked,
 	} {
 		if committed {
 			m.offences.WithLabelValues(kind).Inc()