rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

docs/metrics.md

@@ -1,8 +1,9 @@
 # The metrics
 
-What `GET /_smallwebwaf/metrics` answers with. "Metrics endpoint" in
-[`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus keeps the `instance`
-label as `exported_instance` unless the scrape sets `honor_labels: true`.
+What `GET /_smallwebwaf/metrics` answers with, at `servewaf`'s own address.
+"Metrics endpoint" in [`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus
+keeps the `instance` label as `exported_instance` unless the scrape sets
+`honor_labels: true`. `rproxy` has no metrics.
 
 ## Traffic
 
@@ -11,14 +12,13 @@ label as `exported_instance` unless the scrape sets `honor_labels: true`.
   `action`;
 - `smallwebwaf_request_duration_seconds` and
   `smallwebwaf_upstream_duration_seconds`, as histograms;
-- `smallwebwaf_requests_in_flight`.
+- `smallwebwaf_requests_in_flight`: the questions and requests to its own
+  endpoints that `servewaf` is handling.
 
 ## Limits and bans
 
 - `smallwebwaf_rate_limit_hits_total`, by `window` and by `kind` (`requests`,
   `bytes` or `refusals`);
-- `smallwebwaf_size_and_time_limit_hits_total`, by `limit`, the setting passed.
-  `servewaf`'s header limits have no setting, so it leaves them out;
 - `smallwebwaf_offences_total`, by `kind`;
 - `smallwebwaf_bans_made_total`, by `cause`;
 - `smallwebwaf_active_bans` and `smallwebwaf_permanent_bans`.
@@ -81,11 +81,11 @@ By `file`:
   `smallwebwaf_alerts_dropped_total`;
 - Go's own `go_` metrics and the process's `process_` metrics.
 
-## `servewaf`
+## When a request is counted
 
-`smallwebwaf servewaf` counts a denied request at its decision. It counts an
-allowed request when its report comes, with the status, bytes and times the
-report gives. These are not counted:
+`servewaf` counts a denied request at its decision, and a request to its own
+endpoints when it is answered. It counts an allowed request when its report
+comes, with the status, bytes and times the report gives. These are not counted:
 
 - a report itself;
 - an allowed request whose report never comes;