rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

internal/proxy/reputation_test.go

@@ -272,6 +272,7 @@ func TestEachBlocklistThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 			Instance: alertInstance,
 			Time:     clk.Now(),
 			Event:    alerts.EventReputationHit,
+			Host:     appHost,
 			Client:   netip.MustParseAddr(fromDE),
 			Netblock: netip.MustParsePrefix(fromDE + "/32"),
 			ASN:      asnDE,
@@ -289,7 +290,7 @@ func TestEachBlocklistThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 
 	// Each list's hits, none of its fetches failed, and when its copy was
 	// fetched, 0 for the one without.
-	metrics := s.scrape(unplaced)
+	metrics := s.scrape()
 	fetched := float64(listsFetched().Unix())
 
 	for listURL, want := range map[string]struct{ hits, fetched float64 }{
@@ -513,6 +514,7 @@ func TestEachZoneThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 			Instance: alertInstance,
 			Time:     clk.Now(),
 			Event:    alerts.EventReputationHit,
+			Host:     appHost,
 			Client:   netip.MustParseAddr(fromDE),
 			Netblock: netip.MustParsePrefix(fromDE + "/32"),
 			ASN:      asnDE,
@@ -530,7 +532,7 @@ func TestEachZoneThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 
 	// Each zone's hits, and its queries and their failures, none, since
 	// every client had its verdicts.
-	metrics := s.scrape(unplaced)
+	metrics := s.scrape()
 
 	for _, zone := range []string{dnsblZone, otherZone} {
 		labels := `{instance="` + alertInstance + `",source="` + zone + `"}`
@@ -564,7 +566,7 @@ func TestZoneKeyIsMaskedInTheLogTheAlertAndTheMetrics(t *testing.T) {
 			masked)
 	}
 
-	metrics := s.scrape(unplaced)
+	metrics := s.scrape()
 	wantMetric(t, metrics, `smallwebwaf_reputation_hits_total{instance="`+
 		alertInstance+`",source="`+masked+`"}`, 1)
 
@@ -737,10 +739,6 @@ func TestClientRefusedForAnOffenceIsCheckedWithAbuseIPDBAtItsNextRequest(t *test
 			"a trap path", "/xmlrpc.php", http.StatusForbidden, requestlog.ActionBanned,
 			ratelimit.Offences{Attack: 1},
 		},
-		{
-			"a missing token", proxy.MetricsPath, http.StatusUnauthorized,
-			requestlog.ActionAdmin, ratelimit.Offences{TokenRefused: 1},
-		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -748,7 +746,7 @@ func TestClientRefusedForAnOffenceIsCheckedWithAbuseIPDBAtItsNextRequest(t *test
 			s, clk, server := startWithClock(t, "", map[string]string{
 				abuseIPDBKey: accountKey, reputationAction: actionLog,
 				rulesDir: writeRules(t, testRules), attackBanDuration: "1h",
-				trapPaths: trapPathList, metricsToken: token, wafMode: block,
+				trapPaths: trapPathList, wafMode: block,
 			})
 
 			s.request(client, tc.path, tc.status, tc.action)
@@ -862,7 +860,7 @@ func TestAbuseIPDBHitRaisesAnAlertWithTheScoreOncePerCooldownAndIsCounted(
 
 	// The hits, and the checks, none, since no client committed an
 	// offence, so that the whole budget is left.
-	metrics := s.scrape(unplaced)
+	metrics := s.scrape()
 	labels := `{instance="` + alertInstance + `",source="` + abuseipdb + `"}`
 
 	wantMetric(t, metrics, "smallwebwaf_reputation_hits_total"+labels, 2)
@@ -889,7 +887,7 @@ func TestWithoutAnAbuseIPDBKeyNoClientIsCheckedNorAScoreUsed(t *testing.T) {
 	wantReputation(t, s.get(fromDE, http.StatusOK, forward))
 	wantAbuseIPDBChecks(t, server, 0)
 
-	wantNoSeries(t, s.scrape(unplaced), `smallwebwaf_reputation_daily_budget_remaining{`+
+	wantNoSeries(t, s.scrape(), `smallwebwaf_reputation_daily_budget_remaining{`+
 		`instance="`+alertInstance+`",source="`+abuseipdb+`"}`)
 }