Rename the program to sww and its deciding daemon to discriminator

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the SWW_COMMAND setting, the OS user, and the state
and rules directories.

No logic changes. make check passes.

Model: deepseek-v4-pro

docs/metrics.md

@@ -1,90 +1,81 @@
 # The metrics
 
-What `GET /_smallwebwaf/metrics` answers with, at `servewaf`'s own address.
+What `GET /_sww/metrics` answers with, at `discriminator`'s own address.
 "Metrics endpoint" in [`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus
 keeps the `instance` label as `exported_instance` unless the scrape sets
 `honor_labels: true`. `rproxy` has no metrics.
 
 ## Traffic
 
-- `smallwebwaf_requests_total`, `smallwebwaf_request_bytes_total` and
-  `smallwebwaf_response_bytes_total`, by `status_class` such as `2xx` and by
-  `action`;
-- `smallwebwaf_request_duration_seconds` and
-  `smallwebwaf_upstream_duration_seconds`, as histograms;
-- `smallwebwaf_requests_in_flight`: the questions and requests to its own
-  endpoints that `servewaf` is handling.
+- `sww_requests_total`, `sww_request_bytes_total` and
+  `sww_response_bytes_total`, by `status_class` such as `2xx` and by `action`;
+- `sww_request_duration_seconds` and `sww_upstream_duration_seconds`, as
+  histograms;
+- `sww_requests_in_flight`: the questions and requests to its own endpoints that
+  `discriminator` is handling.
 
 ## Limits and bans
 
-- `smallwebwaf_rate_limit_hits_total`, by `window` and by `kind` (`requests`,
-  `bytes` or `refusals`);
-- `smallwebwaf_offences_total`, by `kind`;
-- `smallwebwaf_bans_made_total`, by `cause`;
-- `smallwebwaf_active_bans` and `smallwebwaf_permanent_bans`.
+- `sww_rate_limit_hits_total`, by `window` and by `kind` (`requests`, `bytes` or
+  `refusals`);
+- `sww_offences_total`, by `kind`;
+- `sww_bans_made_total`, by `cause`;
+- `sww_active_bans` and `sww_permanent_bans`.
 
 ## Attack detection
 
-- `smallwebwaf_rule_matches_total`, by `rule_id` and `action`, and
-  `smallwebwaf_rules_loaded`;
-- `smallwebwaf_waf_matches_total`, by `mode` and `rule_id`, for the rules that
-  fired.
+- `sww_rule_matches_total`, by `rule_id` and `action`, and `sww_rules_loaded`;
+- `sww_waf_matches_total`, by `mode` and `rule_id`, for the rules that fired.
 
 ## Countries and AS numbers
 
 For the `SWWAF_METRICS_TOP_N` busiest of each, the rest as `other`:
 
-- `smallwebwaf_country_requests_total`,
-  `smallwebwaf_country_request_bytes_total`,
-  `smallwebwaf_country_response_bytes_total` and
-  `smallwebwaf_country_list_refusals_total`, by `country`;
-- `smallwebwaf_asn_requests_total`, `smallwebwaf_asn_request_bytes_total` and
-  `smallwebwaf_asn_response_bytes_total`, by `asn`.
+- `sww_country_requests_total`, `sww_country_request_bytes_total`,
+  `sww_country_response_bytes_total` and `sww_country_list_refusals_total`, by
+  `country`;
+- `sww_asn_requests_total`, `sww_asn_request_bytes_total` and
+  `sww_asn_response_bytes_total`, by `asn`.
 
 ## Lookups
 
-- `smallwebwaf_geojs_requests_total` and `smallwebwaf_geojs_failures_total`;
-- `smallwebwaf_geojs_unanswered_total`: the requests that needed an answer and
-  went on without it;
-- with the file source,
-  `smallwebwaf_lookup_database_last_read_timestamp_seconds` and
-  `smallwebwaf_lookup_database_read_failures_total`.
+- `sww_geojs_requests_total` and `sww_geojs_failures_total`;
+- `sww_geojs_unanswered_total`: the requests that needed an answer and went on
+  without it;
+- with the file source, `sww_lookup_database_last_read_timestamp_seconds` and
+  `sww_lookup_database_read_failures_total`.
 
 ## Reputation sources
 
 By `source`: each list's URL, each zone, and `abuseipdb`:
 
-- `smallwebwaf_reputation_hits_total`, `smallwebwaf_reputation_queries_total`
-  and `smallwebwaf_reputation_failures_total`;
-- `smallwebwaf_reputation_last_fetch_timestamp_seconds`, for a list;
-- `smallwebwaf_reputation_daily_budget_remaining`, for AbuseIPDB.
+- `sww_reputation_hits_total`, `sww_reputation_queries_total` and
+  `sww_reputation_failures_total`;
+- `sww_reputation_last_fetch_timestamp_seconds`, for a list;
+- `sww_reputation_daily_budget_remaining`, for AbuseIPDB.
 
 ## State files
 
 By `file`:
 
-- `smallwebwaf_state_file_writes_total`,
-  `smallwebwaf_state_file_write_failures_total`,
-  `smallwebwaf_state_file_last_write_timestamp_seconds` and
-  `smallwebwaf_state_file_size_bytes`;
-- `smallwebwaf_state_file_edits_taken_in_total` and
-  `smallwebwaf_state_file_edits_set_aside_total`;
-- `smallwebwaf_tracked_clients`: the clients in the table.
+- `sww_state_file_writes_total`, `sww_state_file_write_failures_total`,
+  `sww_state_file_last_write_timestamp_seconds` and `sww_state_file_size_bytes`;
+- `sww_state_file_edits_taken_in_total` and
+  `sww_state_file_edits_set_aside_total`;
+- `sww_tracked_clients`: the clients in the table.
 
 ## Remote log, alerts and the process
 
-- while a syslog server is set, `smallwebwaf_remote_log_lines_sent_total`,
-  `smallwebwaf_remote_log_lines_dropped_total` and
-  `smallwebwaf_remote_log_buffer_depth`;
-- by `destination`, `smallwebwaf_alerts_sent_total`,
-  `smallwebwaf_alerts_failed_total`, `smallwebwaf_alerts_suppressed_total` and
-  `smallwebwaf_alerts_dropped_total`;
+- while a syslog server is set, `sww_remote_log_lines_sent_total`,
+  `sww_remote_log_lines_dropped_total` and `sww_remote_log_buffer_depth`;
+- by `destination`, `sww_alerts_sent_total`, `sww_alerts_failed_total`,
+  `sww_alerts_suppressed_total` and `sww_alerts_dropped_total`;
 - Go's own `go_` metrics and the process's `process_` metrics.
 
 ## When a request is counted
 
-`servewaf` counts a denied request at its decision, and a request to its own
-endpoints when it is answered. It counts an allowed request when its report
+`discriminator` counts a denied request at its decision, and a request to its
+own endpoints when it is answered. It counts an allowed request when its report
 comes, with the status, bytes and times the report gives. These are not counted:
 
 - a report itself;