Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

docs/admin-endpoints.md

@@ -5,16 +5,16 @@ answers them at its own address, on the private network. "Admin endpoints" in
 [`SPEC.md`](../SPEC.md) says how their tokens work.
 
 - `GET /_sww/healthz`: `200` and `ok`, to anyone.
-- `GET /_sww/metrics`: the metrics, for `SWW_METRICS_TOKEN` (see
+- `GET /_sww/metrics`: the metrics, for `SWW_WAF_METRICS_TOKEN` (see
   [`metrics.md`](metrics.md)).
 - `GET /_sww/bans`: every ban held, under `bans`, each as `bans.json` lists it.
-  Needs `SWW_ADMIN_TOKEN`, as do the three below.
+  Needs `SWW_WAF_ADMIN_TOKEN`, as do the three below.
 - `POST /_sww/bans`: bans a netblock. The body is a JSON object of `netblock`,
   `duration` and, if you like, `reason`. `netblock` is a netblock such as
   `203.0.113.0/24`, or a client's address, which bans its IPv4 netblock
-  (`SWW_BAN_SCOPE_V4_PREFIX`) or its IPv6 group. `duration` is a duration such
-  as `1h` or `7d`, or `permanent`. A bad body is answered `400`, saying what is
-  wrong:
+  (`SWW_WAF_BAN_SCOPE_V4_PREFIX`) or its IPv6 group. `duration` is a duration
+  such as `1h` or `7d`, or `permanent`. A bad body is answered `400`, saying
+  what is wrong:
     - one that is not such an object, or has another field;
     - one longer than 4 KiB;
     - one that names an IPv4-mapped netblock, or an address with a zone.
@@ -38,7 +38,7 @@ answered `404`, so that the app never sees that prefix (see "`rproxy`" in
 
 ## Examples
 
-With `SWW_ADMIN_TOKEN` set, the token in `$TOKEN`, and `waf` reached as
+With `SWW_WAF_ADMIN_TOKEN` set, the token in `$TOKEN`, and `waf` reached as
 `waf:8080` on its network:
 
 ```sh