Rename the program to sww and its deciding daemon to discriminator

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the SWW_COMMAND setting, the OS user, and the state
and rules directories.

No logic changes. make check passes.

Model: deepseek-v4-pro

docs/request-log.md

@@ -1,32 +1,32 @@
 # The request log's fields
 
-The fields of the JSON objects `rproxy` and `servewaf` write about each request.
-"Request log" and "The log" in [`SPEC.md`](../SPEC.md) say when a line is
-written and how the log is sent to a syslog server. A field that does not apply
-to a request is left out.
+The fields of the JSON objects `rproxy` and `discriminator` write about each
+request. "Request log" and "The log" in [`SPEC.md`](../SPEC.md) say when a line
+is written and how the log is sent to a syslog server. A field that does not
+apply to a request is left out.
 
-## `servewaf`'s lines
+## `discriminator`'s lines
 
-`smallwebwaf servewaf` writes two lines for each question it answers, joined by
-`request_id`. The field `servewaf_line` says which of the two a line is:
+`sww discriminator` writes two lines for each question it answers, joined by
+`request_id`. The field `discriminator_line` says which of the two a line is:
 
 - `decision`: the line it writes once it has answered the question;
 - `report`: the line it writes when `rproxy`'s report comes, with everything
   known. The repetition is intended.
 
-A request to its own endpoints writes one line, without `servewaf_line`. A
+A request to its own endpoints writes one line, without `discriminator_line`. A
 report writes no line but the `report` line of the request it names.
 
 These questions write no line:
 
-- a question refused with `400` (see "The question" under "`servewaf`" in
+- a question refused with `400` (see "The question" under "`discriminator`" in
   [`SPEC.md`](../SPEC.md));
 - a question whose body stopped arriving, which gets no answer.
 
 A `report` line:
 
 ```
-{"type":"request","servewaf_line":"report","time":"2026-10-03T12:00:00.123Z","instance":"fsn1/servewaf","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"waf_score":0,"duration_total":3.217,"duration_checks":0.041,"duration_waf":0.029,"duration_upstream_total":3.104}
+{"type":"request","discriminator_line":"report","time":"2026-10-03T12:00:00.123Z","instance":"fsn1/discriminator","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"waf_score":0,"duration_total":3.217,"duration_checks":0.041,"duration_waf":0.029,"duration_upstream_total":3.104}
 ```
 
 ### Every line
@@ -41,7 +41,7 @@ Every one of these lines has:
 
 ### Standard web log fields
 
-- `time`: when `servewaf` had read the question's body, RFC 3339 with
+- `time`: when `discriminator` had read the question's body, RFC 3339 with
   milliseconds, in UTC. The `report` line gives the same time as the `decision`
   line.
 - `instance`: `SWWAF_INSTANCE_NAME`.
@@ -52,8 +52,9 @@ Every one of these lines has:
 - `host`: the site the visitor asked for.
 - `protocol`: the question's own, `HTTP/1.1`.
 - `status`:
-    - on the `decision` line, what `servewaf` answered: `200` for `allow`, the
-      status of `deny`, or `0` for `close`, as the visitor is then sent nothing;
+    - on the `decision` line, what `discriminator` answered: `200` for `allow`,
+      the status of `deny`, or `0` for `close`, as the visitor is then sent
+      nothing;
     - on the `report` line, what the visitor got, `0` if nothing.
 - `request_bytes`:
     - on the `decision` line, how much of the question's body the Core Rule Set
@@ -61,7 +62,7 @@ Every one of these lines has:
     - on the `report` line, the bytes of the visitor's body that `rproxy` read,
       with what a WebSocket carried from the visitor.
 - `response_bytes`:
-    - on the `decision` line, the body of `servewaf`'s answer;
+    - on the `decision` line, the body of `discriminator`'s answer;
     - on the `report` line, the bytes of the answer's body, with what a
       WebSocket carried from the app.
 - `referer` and `user_agent`.
@@ -78,7 +79,7 @@ Every one of these lines has:
     - lookups are off;
     - the client is not looked up;
     - the source cannot place the client;
-    - GeoJS had not answered by the time `servewaf` answered.
+    - GeoJS had not answered by the time `discriminator` answered.
 - `content_type`: the visitor's `Content-Type`.
 - `content_length`: the body length the visitor announced.
 - `request_headers`: the headers listed in `SWWAF_LOG_REQUEST_HEADERS`, by name
@@ -88,7 +89,7 @@ Every one of these lines has:
 
 ### Response detail
 
-- `response_content_type`: the type of `servewaf`'s own answer.
+- `response_content_type`: the type of `discriminator`'s own answer.
 - `aborted`: true when `rproxy` went away before the answer.
 
 ### Decision
@@ -102,8 +103,8 @@ Every one of these lines has:
     - `country_denied`, `rate_limited`, `rule_blocked` and `waf_blocked`:
       refused by that check;
     - `too_large`: over a header limit;
-    - `admin`: answered at one of `servewaf`'s own endpoints, or `404` for a
-      path under `/_smallwebwaf/`.
+    - `admin`: answered at one of `discriminator`'s own endpoints, or `404` for
+      a path under `/_sww/`.
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a
   request it would have refused. `action` then names what was done, normally
   `forward`.
@@ -147,8 +148,8 @@ Every one of these lines has:
 All in milliseconds:
 
 - `duration_total`:
-    - on the `decision` line, from `servewaf` having read the question's body to
-      the line;
+    - on the `decision` line, from `discriminator` having read the question's
+      body to the line;
     - on the `report` line, from `rproxy` having read the request's headers to
       the end of the answer.
 - `duration_checks`: to the end of the checks;
@@ -158,8 +159,8 @@ All in milliseconds:
 
 ### Requests to its own endpoints
 
-The line of a request to `servewaf`'s own endpoints has these fields, with these
-meanings where they differ:
+The line of a request to `discriminator`'s own endpoints has these fields, with
+these meanings where they differ:
 
 - `client_ip` and `peer_ip`: the request's TCP peer.
 - `request_id`: a new random one of 26 letters and digits.
@@ -171,8 +172,8 @@ meanings where they differ:
 
 ## `rproxy`'s line
 
-`smallwebwaf rproxy` writes one short line for each request. `request_id` joins
-it to `servewaf`'s two. It has these fields and no others:
+`sww rproxy` writes one short line for each request. `request_id` joins it to
+`discriminator`'s two. It has these fields and no others:
 
 - `type`: `request`.
 - `time`: when the request arrived, RFC 3339 with milliseconds, in UTC.
@@ -187,15 +188,15 @@ it to `servewaf`'s two. It has these fields and no others:
   carried from the app.
 - `duration_request`: milliseconds from the request's headers being read until
   the app had been sent the whole request, or the answer started if that was
-  sooner. It includes the wait for `servewaf`.
+  sooner. It includes the wait for `discriminator`.
 - `duration_response`: milliseconds from then until the end of the answer.
 - `disposition`: what was done with the request: `allow`, `deny` or `close`. It
-  is `servewaf`'s answer, or the value of `SWRP_DEFAULT_DISPOSITION`. It is left
-  out when:
-    - `servewaf` was not asked, as for the health check;
-    - the visitor went away while `servewaf` was being asked;
-    - `servewaf`'s answer had no valid `X-Smallwebwaf-Disposition`;
-    - `rproxy` could not pass on `servewaf`'s answer, and answered `502`.
+  is `discriminator`'s answer, or the value of `SWRP_DEFAULT_DISPOSITION`. It is
+  left out when:
+    - `discriminator` was not asked, as for the health check;
+    - the visitor went away while `discriminator` was being asked;
+    - `discriminator`'s answer had no valid `X-Sww-Disposition`;
+    - `rproxy` could not pass on `discriminator`'s answer, and answered `502`.
 - `default_disposition`: `true` when `SWRP_DEFAULT_DISPOSITION` gave
   `disposition`, and otherwise left out.