rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

SPEC.md

@@ -1575,13 +1575,12 @@ It sets no `ENTRYPOINT` or `USER` of its own. The container must start
   writes. `runsvinit` starts runit's `runsvdir`, which runs the `run` script of
   each directory under `/etc/service`. Ubuntu's `sv` looks for services there
   too.
-- The image's `run` script is `/etc/service/smallwebwaf/run`. It starts
-  `servewaf` when `SMALLWEBWAF_COMMAND` is `servewaf`, and `rproxy` when it is
-  `rproxy`, unset or empty. It runs either as the `smallwebwaf` user (uid and
-  gid 65532), with runit's `chpst`. For `servewaf`, it first makes
-  `SWWAF_STATE_DIR` and every file in it belong to that user. For `rproxy` it
-  changes no owner. With any other value, it starts nothing, and stops with a
-  message naming `SMALLWEBWAF_COMMAND` and its value.
+- The image's `run` script, `/etc/service/smallwebwaf/run`, starts the command
+  `SMALLWEBWAF_COMMAND` names, `rproxy` when it is unset or empty, as the
+  `smallwebwaf` user (uid and gid 65532) with runit's `chpst`. For `servewaf`,
+  it first makes `SWWAF_STATE_DIR` and every file in it belong to that user. For
+  `rproxy` it changes no owner. With any other value, it starts nothing, and
+  stops with a message naming `SMALLWEBWAF_COMMAND` and its value.
 
 Every `run` script, the app's included, is a bash script. It starts with
 `#!/usr/bin/env bash` and `set -euo pipefail`, and puts its code in a `main`
@@ -1701,14 +1700,15 @@ ranges traefik is on.
 
 ### upaas
 
-upaas rebuilds and restarts an app's Docker container when its repository
-changes. An app it deploys takes the shape of "`rproxy` in the app's container"
-with no change to upaas. upaas builds the app's Dockerfile and runs the one
-container as it runs any app. The traefik labels route to port 8080, and the
-`SWRP_` settings go with the app's environment variables. `servewaf` runs in a
-container of its own, on a network the app's container can reach, with its state
-volume and the directory of any token file. `docs/gitea.md` records what the
-defaults do in front of gitea, and `script/gitea-requests` checks those notes.
+An app deployed by upaas, which rebuilds and restarts an app's Docker container
+when its repository changes, takes the shape of "`rproxy` in the app's
+container" with no change to upaas. upaas builds the app's Dockerfile and runs
+the one container as it runs any app. The traefik labels route to port 8080, and
+the `SWRP_` settings go with the app's environment variables. `servewaf` runs in
+a container of its own, on a network the app's container can reach, with its
+state volume and the directory of any token file. `docs/gitea.md` records what
+the defaults do in front of gitea, and `script/gitea-requests` checks those
+notes.
 
 ## Planned, not built