Fix rules CSV parsing and add rule text editing API

Strip a leading UTF-8 BOM before parsing rule CSVs (it was causing the
header row to be misread as a rule) and skip rows that clearly failed
CSV parsing (e.g. a whole line landing in the rule_number field after
a spreadsheet app double-encoded a quoted cell) instead of silently
loading garbage.

Add PUT /api/rules/{lang}/{number} and GET /api/rules/numbers so rule
text, suggested penalty and escalation mode can be edited per language
from the admin UI, always writing the CSV back out with correct
quoting via encoding/csv. Also fixes two bugs found while wiring this
up: rulesDir() ignored the configured rules_dir (falling back to a
RULES_DIR env var that's never set), and the CORS middleware didn't
allow PUT.

main.go

@@ -29,6 +29,7 @@ type Config struct {
 var corsOrigins []string
 var crossSiteCookies bool
 var backupDir string
+var configuredRulesDir string
 
 func defaultConfig() *Config {
 	return &Config{
@@ -128,6 +129,7 @@ func main() {
 	corsOrigins = cfg.CORSOrigins
 	crossSiteCookies = cfg.CrossSiteCookies
 	backupDir = cfg.BackupDir
+	configuredRulesDir = cfg.RulesDir
 
 	if err := openDB(cfg.DBPath); err != nil {
 		log.Fatalf("db open: %v", err)
@@ -285,7 +287,7 @@ func withCORS(next http.Handler) http.Handler {
 			w.Header().Set("Access-Control-Allow-Origin", origin)
 			w.Header().Set("Vary", "Origin")
 			w.Header().Set("Access-Control-Allow-Credentials", "true")
-			w.Header().Set("Access-Control-Allow-Methods", "GET,POST,PATCH,DELETE,OPTIONS")
+			w.Header().Set("Access-Control-Allow-Methods", "GET,POST,PUT,PATCH,DELETE,OPTIONS")
 			reqHeaders := r.Header.Get("Access-Control-Request-Headers")
 			if reqHeaders == "" {
 				reqHeaders = "Content-Type"