Say that rproxy passes a refused question's 400 to the visitor (closes #326)

The comment above readQuestion said rproxy treats a 400 without a
disposition as no answer. It passes that 400 to the visitor, and its
default disposition does not apply, as SPEC.md and internal/rproxy/waf.go
say. Comment only.

Model: opus-5-5

internal/waf/waf.go

@@ -215,10 +215,10 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 
 // readQuestion returns the visitor's address and the body a question carries,
 // and whether waf takes the question. It answers a question it does not
-// take with 400 and no disposition, which rproxy treats as it treats no
-// answer. The id of a question it takes is held from here on, without a
-// decision yet, so that another question with that id is refused while this
-// one is being handled.
+// take with 400 and no disposition. rproxy passes that 400 to the visitor,
+// and its default disposition does not apply. The id of a question it takes
+// is held from here on, without a decision yet, so that another question with
+// that id is refused while this one is being handled.
 //
 // The body is read before any check, since Go's server does not send an answer
 // until it has read the body. A question whose body stops arriving gets no