Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

script/run

@@ -2,12 +2,12 @@
 # script/run: build bin/sww with script/build and run waf and
 # rproxy on the host, with the settings in the environment, until rproxy
 # exits or the script is told to stop. rproxy listens on port 8080 unless
-# SWRP_LISTEN_ADDR says otherwise, in front of the app at SWRP_UPSTREAM_URL.
-# waf listens on port 8090 unless SWW_LISTEN_ADDR says otherwise, and
-# rproxy asks it there unless SWRP_WAF_BACKEND says otherwise. Unless
-# SWW_STATE_DIR is set, the state files go in bin/state, beside the binary,
-# and unless SWW_CACHE_DIR is set, the cache files go in bin/cache. Unless
-# SWW_RULES_DIR is set, the rule files are those of share/rules.d, which the
+# SWW_RPROXY_LISTEN_ADDR says otherwise, in front of the app at SWW_RPROXY_UPSTREAM_URL.
+# waf listens on port 8090 unless SWW_WAF_LISTEN_ADDR says otherwise, and
+# rproxy asks it there unless SWW_RPROXY_WAF_BACKEND says otherwise. Unless
+# SWW_WAF_STATE_DIR is set, the state files go in bin/state, beside the binary,
+# and unless SWW_WAF_CACHE_DIR is set, the cache files go in bin/cache. Unless
+# SWW_WAF_RULES_DIR is set, the rule files are those of share/rules.d, which the
 # image ships.
 set -eu
 
@@ -27,23 +27,23 @@ stop_both() {
 
 main() {
     "$SCRIPT_DIR/build"
-    if [ -z "${SWW_STATE_DIR+set}" ]; then
-        SWW_STATE_DIR="$ROOT/bin/state"
-        export SWW_STATE_DIR
-        mkdir -p "$SWW_STATE_DIR"
+    if [ -z "${SWW_WAF_STATE_DIR+set}" ]; then
+        SWW_WAF_STATE_DIR="$ROOT/bin/state"
+        export SWW_WAF_STATE_DIR
+        mkdir -p "$SWW_WAF_STATE_DIR"
     fi
-    if [ -z "${SWW_CACHE_DIR+set}" ]; then
-        SWW_CACHE_DIR="$ROOT/bin/cache"
-        export SWW_CACHE_DIR
-        mkdir -p "$SWW_CACHE_DIR"
+    if [ -z "${SWW_WAF_CACHE_DIR+set}" ]; then
+        SWW_WAF_CACHE_DIR="$ROOT/bin/cache"
+        export SWW_WAF_CACHE_DIR
+        mkdir -p "$SWW_WAF_CACHE_DIR"
     fi
-    if [ -z "${SWW_RULES_DIR+set}" ]; then
-        SWW_RULES_DIR="$ROOT/share/rules.d"
-        export SWW_RULES_DIR
+    if [ -z "${SWW_WAF_RULES_DIR+set}" ]; then
+        SWW_WAF_RULES_DIR="$ROOT/share/rules.d"
+        export SWW_WAF_RULES_DIR
     fi
-    SWW_LISTEN_ADDR="${SWW_LISTEN_ADDR:-:8090}"
-    SWRP_WAF_BACKEND="${SWRP_WAF_BACKEND:-http://127.0.0.1:${SWW_LISTEN_ADDR##*:}}"
-    export SWW_LISTEN_ADDR SWRP_WAF_BACKEND
+    SWW_WAF_LISTEN_ADDR="${SWW_WAF_LISTEN_ADDR:-:8090}"
+    SWW_RPROXY_WAF_BACKEND="${SWW_RPROXY_WAF_BACKEND:-http://127.0.0.1:${SWW_WAF_LISTEN_ADDR##*:}}"
+    export SWW_WAF_LISTEN_ADDR SWW_RPROXY_WAF_BACKEND
 
     trap stop_both EXIT
     trap 'exit 1' HUP INT TERM