Rename the program to sww and its deciding daemon to discriminator

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the SWW_COMMAND setting, the OS user, and the state
and rules directories.

No logic changes. make check passes.

Model: deepseek-v4-pro

script/run

@@ -1,9 +1,9 @@
 #!/bin/sh
-# script/run: build bin/smallwebwaf with script/build and run servewaf and
+# script/run: build bin/sww with script/build and run discriminator and
 # rproxy on the host, with the settings in the environment, until rproxy
 # exits or the script is told to stop. rproxy listens on port 8080 unless
 # SWRP_LISTEN_ADDR says otherwise, in front of the app at SWRP_UPSTREAM_URL.
-# servewaf listens on port 8090 unless SWWAF_LISTEN_ADDR says otherwise, and
+# discriminator listens on port 8090 unless SWWAF_LISTEN_ADDR says otherwise, and
 # rproxy asks it there unless SWRP_WAF_BACKEND says otherwise. Unless
 # SWWAF_STATE_DIR is set, the state files go in bin/state, beside the binary,
 # and unless SWWAF_RULES_DIR is set, the rule files are those of share/rules.d,
@@ -13,14 +13,14 @@ set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
-SERVEWAF=""
+DISCRIMINATOR=""
 RPROXY=""
 
-# stop_both: stop what runs, and wait for it, so that servewaf writes its state
+# stop_both: stop what runs, and wait for it, so that discriminator writes its state
 # files.
 stop_both() {
     trap '' HUP INT TERM
-    kill $SERVEWAF $RPROXY 2>/dev/null || true
+    kill $DISCRIMINATOR $RPROXY 2>/dev/null || true
     wait || true
 }
 
@@ -42,9 +42,9 @@ main() {
     trap stop_both EXIT
     trap 'exit 1' HUP INT TERM
 
-    "$ROOT/bin/smallwebwaf" servewaf &
-    SERVEWAF=$!
-    "$ROOT/bin/smallwebwaf" rproxy &
+    "$ROOT/bin/sww" discriminator &
+    DISCRIMINATOR=$!
+    "$ROOT/bin/sww" rproxy &
     RPROXY=$!
     wait "$RPROXY"
 }