Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

docs/state-files.md

@@ -4,15 +4,15 @@ The JSON files `waf` keeps, and what each holds. "Persistent state" in
 [`SPEC.md`](../SPEC.md) says how they are written, read and edited. Each has a
 top-level `version` of 1.
 
-- The state files are in `SWW_STATE_DIR`, `/var/lib/sww` by default. They hold
-  what cannot be fetched again, so back them up:
+- The state files are in `SWW_WAF_STATE_DIR`, `/var/lib/sww` by default. They
+  hold what cannot be fetched again, so back them up:
     - `bans.json`;
     - `clients.json`;
     - `abuseipdb-checks-spent.json`;
     - `alerts.json`.
-- The cache files are in `SWW_CACHE_DIR`, `/var/cache/sww` by default. They hold
-  answers from outside services, which are asked again when a file is lost, so
-  the directory can be left out of backups:
+- The cache files are in `SWW_WAF_CACHE_DIR`, `/var/cache/sww` by default. They
+  hold answers from outside services, which are asked again when a file is lost,
+  so the directory can be left out of backups:
     - `lookups.json`;
     - `lists.json`;
     - `dnsbl.json`;
@@ -21,8 +21,8 @@ top-level `version` of 1.
 
 ## `bans.json`
 
-Active and past bans: every ban an admin made, and up to `SWW_MAX_BANS` of those
-`waf` made. Per entry:
+Active and past bans: every ban an admin made, and up to `SWW_WAF_MAX_BANS` of
+those `waf` made. Per entry:
 
 - `netblock`, `start` and `expires` (`null` for a permanent ban);
 - `cause`: `attack`, `limit`, `admin` or `crowdsec`;
@@ -146,10 +146,10 @@ A cache file. routewatch's answers from the last hour, one per line:
 ## Sizes
 
 - `clients.json`: about 1 KiB per client, about 20 MiB at the default
-  `SWW_MAX_TRACKED_CLIENTS`. Written every 15 minutes, that is under 2 GiB of
-  disk writes a day.
+  `SWW_WAF_MAX_TRACKED_CLIENTS`. Written every 15 minutes, that is under 2 GiB
+  of disk writes a day.
 - `bans.json`: about 1.2 KiB per ban, at most about 2.5 KiB, so about 6 MiB at
-  the default `SWW_MAX_BANS`. Written every 15 minutes, a full file comes to
+  the default `SWW_WAF_MAX_BANS`. Written every 15 minutes, a full file comes to
   about 600 MiB of writes a day, and a hundred new bans a day add about 600 MiB
   more.
 - `lookups.json`: about 150 bytes per answer, under 1.5 GiB of writes a day when