Rename the program to sww and its deciding daemon to discriminator

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the SWW_COMMAND setting, the OS user, and the state
and rules directories.

No logic changes. make check passes.

Model: deepseek-v4-pro

internal/config/rproxy.go

@@ -12,7 +12,7 @@ import (
 	"time"
 )
 
-// RProxy is the settings of `smallwebwaf rproxy`. A size or time limit of zero
+// RProxy is the settings of `sww rproxy`. A size or time limit of zero
 // is off.
 type RProxy struct {
 	// ListenAddr is where rproxy listens (SWRP_LISTEN_ADDR).
@@ -22,12 +22,12 @@ type RProxy struct {
 	// TrustedProxies are the netblocks whose X-Forwarded-For is believed
 	// (SWRP_TRUSTED_PROXIES).
 	TrustedProxies []netip.Prefix
-	// WAFBackend is servewaf's URL (SWRP_WAF_BACKEND).
+	// WAFBackend is discriminator's URL (SWRP_WAF_BACKEND).
 	WAFBackend *url.URL
-	// Timeout is how long rproxy waits for servewaf's answer to a question,
+	// Timeout is how long rproxy waits for discriminator's answer to a question,
 	// and to a report (SWRP_TIMEOUT_MS). It cannot be off.
 	Timeout time.Duration
-	// DefaultDisposition is what is done with a request when servewaf cannot be
+	// DefaultDisposition is what is done with a request when discriminator cannot be
 	// connected to, does not answer at all, or does not answer within Timeout:
 	// allow or deny (SWRP_DEFAULT_DISPOSITION).
 	DefaultDisposition string
@@ -50,7 +50,7 @@ type RProxy struct {
 
 var (
 	errNeedsWAFBackend = errors.New(
-		"is required: it is servewaf's URL, such as http://servewaf:8080")
+		"is required: it is discriminator's URL, such as http://discriminator:8080")
 	errNotDisposition  = errors.New("is not allow or deny")
 	errNotMilliseconds = errors.New(
 		"is not a whole number of milliseconds above zero, such as 2000")
@@ -124,7 +124,7 @@ func (c *RProxy) LogValue() slog.Value {
 	return slog.GroupValue(c.settings...)
 }
 
-// wafBackend reads the setting that is servewaf's URL, which must be set.
+// wafBackend reads the setting that is discriminator's URL, which must be set.
 func (e *environment) wafBackend(name string) *url.URL {
 	value := e.value(name, "")
 	if value == "" {
@@ -139,7 +139,7 @@ func (e *environment) wafBackend(name string) *url.URL {
 	return backend
 }
 
-// disposition reads the setting that is what is done with a request when servewaf
+// disposition reads the setting that is what is done with a request when discriminator
 // cannot be connected to, does not answer at all, or does not answer in time:
 // allow or deny.
 func (e *environment) disposition(name, defaultValue string) string {