servewaf answers rproxy's question about each request and takes its report (closes #170)

`smallwebwaf servewaf` runs today's checks on the visitor's request each
question carries, answers rproxy, and passes nothing to an app. rproxy reports
every request servewaf answered. A report counts an allowed request's bytes and
writes servewaf's second log line. The table holds a copy of what a report
needs, never the request, so a report cannot reach a request being handled.

Judgement call: a question's body is read before any check; over 64 KiB gets 400.
Judgement call: a report's bytes and durations have ceilings, so they cannot overflow.
Judgement call: a `close` disposition for SWWAF_BAN_RESPONSE=close.

Model: opus-5-5

docs/admin-endpoints.md

@@ -46,3 +46,8 @@ curl -H "Authorization: Bearer $TOKEN" -X DELETE \
 curl -H "Authorization: Bearer $TOKEN" \
     https://app.example/_smallwebwaf/clients/203.0.113.9
 ```
+
+## `servewaf`
+
+`smallwebwaf servewaf` answers these endpoints at its own address. No check runs
+on those requests (see "`servewaf`" in [`SPEC.md`](../SPEC.md)).