Rename the program to sww and its deciding daemon to discriminator

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the SWW_COMMAND setting, the OS user, and the state
and rules directories.

No logic changes. make check passes.

Model: deepseek-v4-pro

docs/rules.md

@@ -32,7 +32,7 @@ scanner-agent  user_agent  ban     (?i)\b(sqlmap|nikto|nuclei|wpscan)\b
 ## The default file
 
 The image ships one file, `share/rules.d/00-default.rules`, installed as
-`/etc/smallwebwaf/rules.d/00-default.rules`:
+`/etc/sww/rules.d/00-default.rules`:
 
 ```
 # 00-default.rules: probes no real visitor sends, anchored at the site root
@@ -54,19 +54,20 @@ empty-agent      user_agent  log     ^$
 
 ## A file of your own
 
-`servewaf` reads the rule files in its own container. Rules of your own go in a
-file named to sort after the default, such as `50-site.rules`:
+`discriminator` reads the rule files in its own container. Rules of your own go
+in a file named to sort after the default, such as `50-site.rules`:
 
 ```
 # 50-site.rules: WordPress probes, which this site never serves
 wp-probe         path        ban     (?i)^/(wp-login\.php|xmlrpc\.php|wp-admin/)
 ```
 
-A `Dockerfile` built on the `smallwebwaf` image, for `servewaf` to run from,
-adds it:
+A `Dockerfile` built on the `smallwebwaf` image, for `discriminator` to run
+from, adds it:
 
 ```dockerfile
-COPY 50-site.rules /etc/smallwebwaf/rules.d/50-site.rules
+COPY 50-site.rules /etc/sww/rules.d/50-site.rules
 ```
 
-Or mount it there. A `path` rule applies on every site behind that `servewaf`.
+Or mount it there. A `path` rule applies on every site behind that
+`discriminator`.