Name request log actions so they say what they mean (closes #229)

The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported.

Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent.
Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1.

Model: opus-5-5

internal/ratelimit/ratelimit.go

@@ -122,12 +122,12 @@ type Responses struct {
 type Offences struct {
 	// Limit is its requests that broke a rate limit, a byte limit or the
 	// error burst, Attack those that were a clear sign of attack, a match
-	// of a ban rule or a request for a trap path, RuleBlocked those a block
-	// rule refused, and WAFBlocked those the Core Rule Set refused.
-	Limit       int64 `json:"limit"`
-	Attack      int64 `json:"attack"`
-	RuleBlocked int64 `json:"rule_blocked"`
-	WAFBlocked  int64 `json:"waf_blocked"`
+	// of a ban rule or a request for a trap path, BlockedByBlockRule those a
+	// block rule refused, and WAFBlocked those the Core Rule Set refused.
+	Limit              int64 `json:"limit"`
+	Attack             int64 `json:"attack"`
+	BlockedByBlockRule int64 `json:"blocked_by_block_rule"`
+	WAFBlocked         int64 `json:"waf_blocked"`
 	// TokenRefused is what a clients.json written by an earlier version gives,
 	// which must still load. Nothing adds to it.
 	TokenRefused int64 `json:"token_refused,omitempty"`
@@ -147,12 +147,12 @@ type Request struct {
 	ResponseBytes int64
 	// BrokeLimit is true for a request that broke a rate limit, a byte
 	// limit or the error burst, Attack for one that matched a ban rule or
-	// asked for a trap path, RuleBlocked for one a block rule refused, and
-	// WAFBlocked for one the Core Rule Set refused.
-	BrokeLimit  bool
-	Attack      bool
-	RuleBlocked bool
-	WAFBlocked  bool
+	// asked for a trap path, BlockedByBlockRule for one a block rule refused,
+	// and WAFBlocked for one the Core Rule Set refused.
+	BrokeLimit         bool
+	Attack             bool
+	BlockedByBlockRule bool
+	WAFBlocked         bool
 }
 
 // New returns a Limiter for limits, with no client counted yet, whose
@@ -323,8 +323,8 @@ func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
 		h.Offences.Attack++
 	}
 
-	if r.RuleBlocked {
-		h.Offences.RuleBlocked++
+	if r.BlockedByBlockRule {
+		h.Offences.BlockedByBlockRule++
 	}
 
 	if r.WAFBlocked {