Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/rproxy/waf.go

@@ -65,9 +65,9 @@ func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 		rq.answer(http.StatusBadGateway)
 	default:
 		// waf cannot be connected to, does not answer at all, or does not answer
-		// within SWRP_TIMEOUT_MS. A request that keeps waf busy past
-		// SWRP_TIMEOUT_MS, like any request while waf is overloaded, gets
-		// SWRP_DEFAULT_DISPOSITION here. deny closes this, at the cost of answering 503
+		// within SWW_RPROXY_TIMEOUT_MS. A request that keeps waf busy past
+		// SWW_RPROXY_TIMEOUT_MS, like any request while waf is overloaded, gets
+		// SWW_RPROXY_DEFAULT_DISPOSITION here. deny closes this, at the cost of answering 503
 		// whenever waf is slow. Making such requests hard to send is
 		// https://git.eeqj.de/sneak/smallwebwaf/issues/182.
 		rq.h.processLog.Warn("waf gave no answer", "error", err.Error())
@@ -84,7 +84,7 @@ func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 }
 
 // ask sends waf the question, and returns its answer, which must have come
-// whole within SWRP_TIMEOUT_MS. It ends when ctx does, as when the visitor goes
+// whole within SWW_RPROXY_TIMEOUT_MS. It ends when ctx does, as when the visitor goes
 // away.
 func (rq *request) ask(ctx context.Context) (*wafAnswer, error) {
 	ctx, cancel := context.WithTimeout(ctx, rq.h.config.Timeout)
@@ -228,7 +228,7 @@ func (h *handler) sendReport(ctx context.Context, report *waf.Report) {
 }
 
 // postReport posts report to waf, and waits for its answer for up to
-// SWRP_TIMEOUT_MS.
+// SWW_RPROXY_TIMEOUT_MS.
 func (h *handler) postReport(ctx context.Context, report *waf.Report) error {
 	body, err := json.Marshal(report)
 	if err != nil {