Pass-through proxy with timeouts, size limits and a request log (closes #13)

The repo's first code, with the layout the prompts policies ask for:
Makefile, script/ entrypoints, a Dockerfile whose lint and test phases
gate the build, the Gitea workflow, the canonical dotfiles and
REPO_POLICIES.md. smallwebwaf passes each request to the app through
httputil.ReverseProxy within the four timeouts and two size limits,
works out the client's address behind trusted proxies, and writes one
JSON line per request. The tests run against real local servers.
SPEC.md now says what Go's HTTP server does before smallwebwaf sees a
request; make fmt only rewraps EVALUATION.md.

Model: opus-5-5

internal/proxy/limits_test.go

@@ -29,17 +29,19 @@ func TestRequestBodyLimit(t *testing.T) {
 		announced bool
 		want      int
 		action    string
-		// reachesApp is whether the app sees the request at all.
-		reachesApp bool
+		// refusedBeforeApp is a refusal before anything reaches the app.
+		// A body over the limit with no length given has already partly
+		// reached the app when it is refused.
+		refusedBeforeApp bool
 	}{
 		{"announced, over the limit", 2 * sizeLimit, true,
-			http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge, false},
-		{"announced, at the limit", sizeLimit, true,
-			http.StatusOK, requestlog.ActionForward, true},
-		{"not announced, over the limit", 4 * sizeLimit, false,
 			http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge, true},
+		{"announced, at the limit", sizeLimit, true,
+			http.StatusOK, requestlog.ActionForward, false},
+		{"not announced, over the limit", 4 * sizeLimit, false,
+			http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge, false},
 		{"not announced, at the limit", sizeLimit, false,
-			http.StatusOK, requestlog.ActionForward, true},
+			http.StatusOK, requestlog.ActionForward, false},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -64,8 +66,8 @@ func TestRequestBodyLimit(t *testing.T) {
 				tc.want)
 			wantLine(t, out.requestLine(t), tc.want, tc.action)
 
-			if (calls.Load() > 0) != tc.reachesApp {
-				t.Errorf("the app was called %d times", calls.Load())
+			if tc.refusedBeforeApp && calls.Load() != 0 {
+				t.Errorf("the app was called %d times, want never", calls.Load())
 			}
 		})
 	}