Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/rproxy/rproxy.go

@@ -1,11 +1,11 @@
 // Package rproxy is the reverse proxy in front of one app that asks waf
 // about each request. It passes a request waf allows to the app and the
 // app's answer back, within the size and time limits. Any other answer from
-// waf goes to the visitor as waf gave it. SWRP_DEFAULT_DISPOSITION
+// waf goes to the visitor as waf gave it. SWW_RPROXY_DEFAULT_DISPOSITION
 // decides only when waf cannot be connected to, does not answer at all, or
-// does not answer within SWRP_TIMEOUT_MS. rproxy itself refuses a request with a
+// does not answer within SWW_RPROXY_TIMEOUT_MS. rproxy itself refuses a request with a
 // method it does not pass on, or one it cannot put to waf as the visitor
-// sent it. It keeps nothing between requests and never touches disk. "rproxy" in
+// sent it. It keeps nothing between requests and writes nothing to disk. "rproxy" in
 // SPEC.md says what it does.
 package rproxy
 
@@ -73,7 +73,7 @@ type Server struct {
 
 // New returns the server `sww rproxy` runs. Go's server itself refuses
 // a request line and headers over requestHeaderMaxBytes, with 431, closes a
-// connection idle for idleTimeout, and applies SWRP_MAX_REQUEST_TIME_MS while
+// connection idle for idleTimeout, and applies SWW_RPROXY_MAX_REQUEST_TIME_MS while
 // the headers arrive. The handler applies the time and size limits from then
 // on.
 func New(params Params) *Server {
@@ -105,7 +105,7 @@ func New(params Params) *Server {
 }
 
 // WaitForReports returns once the reports being sent have gone or failed,
-// which SWRP_TIMEOUT_MS bounds. Any report after this call is dropped: that of
+// which SWW_RPROXY_TIMEOUT_MS bounds. Any report after this call is dropped: that of
 // a WebSocket that closes while rproxy stops, for one.
 func (s *Server) WaitForReports() {
 	s.h.reportsMu.Lock()
@@ -214,8 +214,8 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 // passToApp passes the request on to the app, unless a limit or its path keeps
 // it from the app. waf answers a path under ownEndpointPrefix itself, so
-// such a request gets here only when SWRP_DEFAULT_DISPOSITION allowed it. ctx is the
-// request's own context.
+// such a request gets here only when SWW_RPROXY_DEFAULT_DISPOSITION allowed it.
+// ctx is the request's own context.
 func (rq *request) passToApp(ctx context.Context) {
 	maxBytes := rq.h.config.MaxRequestSize