Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/state/state.go

@@ -1,14 +1,14 @@
 // Package state keeps sww's state in JSON files, as the "Persistent
 // state" section of SPEC.md requires and docs/state-files.md lists them.
 //
-// The state files are in SWW_STATE_DIR:
+// The state files are in SWW_WAF_STATE_DIR:
 //   - bans.json holds the bans;
 //   - clients.json holds each client's counters and history;
 //   - abuseipdb-checks-spent.json holds the AbuseIPDB checks spent today;
 //   - alerts.json holds the cooldowns, the hour under way, the alerts
 //     waiting for each destination and the anomaly counters.
 //
-// The cache files are in SWW_CACHE_DIR. Each keeps answers from an
+// The cache files are in SWW_WAF_CACHE_DIR. Each keeps answers from an
 // outside service, which are fetched again when the file is lost:
 //   - lookups.json holds GeoJS's answers;
 //   - lists.json holds the last try and last good copy of each list
@@ -111,17 +111,17 @@ var (
 
 // Params are what Load needs.
 type Params struct {
-	// Dir is the directory of the state files (SWW_STATE_DIR), and
-	// CacheDir that of the cache files (SWW_CACHE_DIR).
+	// Dir is the directory of the state files (SWW_WAF_STATE_DIR), and
+	// CacheDir that of the cache files (SWW_WAF_CACHE_DIR).
 	Dir      string
 	CacheDir string
 	// WriteDelay is how long after a ban is made bans.json is written
-	// (SWW_STATE_WRITE_DELAY), and CounterInterval how often every file
-	// is (SWW_STATE_COUNTER_INTERVAL).
+	// (SWW_WAF_STATE_WRITE_DELAY), and CounterInterval how often every file
+	// is (SWW_WAF_STATE_COUNTER_INTERVAL).
 	WriteDelay      time.Duration
 	CounterInterval time.Duration
 	// Ledger, Limiter, GeoJS, Lists, DNSBL, AbuseIPDB, RouteWatch, Alerts and
-	// Anomalies hold the state. RouteWatch is nil while SWW_ROUTEWATCH_URL is
+	// Anomalies hold the state. RouteWatch is nil while SWW_WAF_ROUTEWATCH_URL is
 	// unset, and routewatch.json then holds no answers. Alerts also receive a
 	// file_error alert for an edit set aside, and for a write that fails while
 	// sww runs.
@@ -257,12 +257,12 @@ type stateFile interface {
 func Load(params Params) (*Files, error) {
 	err := checkWritable(params.Dir)
 	if err != nil {
-		return nil, fmt.Errorf("SWW_STATE_DIR cannot be written: %w", err)
+		return nil, fmt.Errorf("SWW_WAF_STATE_DIR cannot be written: %w", err)
 	}
 
 	err = checkWritable(params.CacheDir)
 	if err != nil {
-		return nil, fmt.Errorf("SWW_CACHE_DIR cannot be written: %w", err)
+		return nil, fmt.Errorf("SWW_WAF_CACHE_DIR cannot be written: %w", err)
 	}
 
 	f := &Files{params: params, sums: map[string][sha256.Size]byte{}}
@@ -1420,7 +1420,8 @@ func write(dir, name string, data []byte) error {
 
 // syncDirectory syncs dir to the disk, so that a rename in it lasts.
 func syncDirectory(dir string) error {
-	directory, err := os.Open(dir) //nolint:gosec // SWW_STATE_DIR or SWW_CACHE_DIR itself
+	//nolint:gosec // SWW_WAF_STATE_DIR or SWW_WAF_CACHE_DIR itself
+	directory, err := os.Open(dir)
 	if err != nil {
 		return err
 	}
@@ -1430,7 +1431,7 @@ func syncDirectory(dir string) error {
 
 // writeSynced writes data to the file at path, and syncs it to the disk.
 func writeSynced(path string, data []byte) error {
-	//nolint:gosec // a file's temporary file, in SWW_STATE_DIR or SWW_CACHE_DIR
+	//nolint:gosec // a file's temporary file, in SWW_WAF_STATE_DIR or SWW_WAF_CACHE_DIR
 	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, fileMode)
 	if err != nil {
 		return err

internal/state/state_test.go

@@ -1160,14 +1160,14 @@ func TestUnwritableDirectoryStopsTheStart(t *testing.T) {
 		filepath.Join(t.TempDir(), "missing"),
 		notADirectory,
 	} {
-		const want = "SWW_STATE_DIR cannot be written: "
+		const want = "SWW_WAF_STATE_DIR cannot be written: "
 
 		_, err := state.Load(newParams(dir))
 		if err == nil || !strings.HasPrefix(err.Error(), want) {
 			t.Errorf("state directory %s: error %v, want one starting %s", dir, err, want)
 		}
 
-		const wantCache = "SWW_CACHE_DIR cannot be written: "
+		const wantCache = "SWW_WAF_CACHE_DIR cannot be written: "
 
 		params := newParams(t.TempDir())
 		params.CacheDir = dir