servewaf answers rproxy's question about each request and takes its report (closes #170)

`smallwebwaf servewaf` runs today's checks on the visitor's request a
question carries and answers allow, deny or close, instead of passing it
to an app. rproxy's report then counts the bytes toward the byte limits
and adds the request to the client's history. SPEC.md gives the exact
question, answer and report, which rproxy follows. `smallwebwaf` with no
command is unchanged.

Judgement call: a third disposition, close, since closing the question's
connection would read as servewaf down and let the request through.
Judgement call: allow can answer a new request id, since a visitor behind
a trusted proxy can choose its own.

Model: opus-5-5

README.md

@@ -339,6 +339,9 @@ pinned.
   [`docs/settings.md`](docs/settings.md)).
 - The state files live in `/var/lib/smallwebwaf`. A volume mounted there keeps
   them across a deploy.
+- `smallwebwaf servewaf` runs the same checks for the sites that ask it about
+  each request, and passes nothing to an app (see "`servewaf`" in
+  [`SPEC.md`](SPEC.md)).
 - `docker stop` stops both processes at once. `smallwebwaf` gives the requests
   in progress five seconds to finish, so the app must keep answering for five
   seconds after `SIGTERM`.
@@ -351,6 +354,8 @@ what each does.
 ## TODO
 
 - Planned, as "Planned, not built" in [`SPEC.md`](SPEC.md) describes:
+    - `smallwebwaf rproxy`, the reverse proxy in front of each app that asks
+      `smallwebwaf servewaf` about each request;
     - sharing bans between the instances of several apps;
     - sending the log over RELP.