fix(waf): continue-on-error + timeout 1s + alle CRS-Dateien — v1.2.73

- SPOE-Config: option continue-on-error — HAProxy blockt nie wegen
  SPOE-Timeout (z.B. CRS-Engine-Load beim ersten Request). Ohne dieses
  Flag waren alle Requests geblockt wenn der WAF-Agent kurz nicht
  antwortete, auch für Domains ohne WAF-Konfiguration.
- SPOE-Config: timeout processing 50ms → 1s — CRS-Load braucht >50ms
- postinst: *.conf → * beim CRS-Copy — .data-Dateien wurden nicht
  mitkopiert, SecRule @pmFromFile scanners-user-agents.data fehlte

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/haproxy/haproxy.go

@@ -142,19 +142,26 @@ func (g *Generator) Render(ctx context.Context) error {
 }
 
 // spoeCfg is the static SPOE configuration for edgeguard-waf.
-// It tells HAProxy which variables to forward and where the agent listens.
+// HAProxy 3.x format: [<engine-name>] section + spoe-agent / spoe-message
+// (no square brackets around spoe-agent/spoe-message keywords).
+// spoeCfg uses `option continue-on-error` so that HAProxy never blocks
+// a request when the SPOE agent is slow or unavailable. Without this,
+// a timeout during CRS engine initialization would block all traffic,
+// including domains without WAF configured.
 const spoeCfg = `# Generated by edgeguard-api. DO NOT EDIT.
-[spoe-agent edgeguard-waf-agent]
-messages    edgeguard-waf-req
-option      var-prefix waf
-timeout     hello      100ms
-timeout     idle       30s
-timeout     processing 50ms
-use-backend spoe-edgeguard-waf
+[edgeguard-waf]
+spoe-agent edgeguard-waf-agent
+    messages        edgeguard-waf-req
+    option          var-prefix waf
+    option          continue-on-error
+    timeout         hello      100ms
+    timeout         idle       30s
+    timeout         processing 1s
+    use-backend     spoe-edgeguard-waf
 
-[spoe-message edgeguard-waf-req]
-args src=src method=method uri=url ver=req.ver headers=req.hdrs host=req.hdr(host)
-event on-frontend-http-request
+spoe-message edgeguard-waf-req
+    args src=src method=method uri=url ver=req.ver headers=req.hdrs host=req.hdr(host)
+    event on-frontend-http-request
 `
 
 // View is what the template consumes. Routes per domain are pre-