Always-on grounded retrieval + role-scoped Ollama models (#62 Phases 1–3) (#65)

## Summary
- Closes Phases 1–3 of [#62](#62) (Phase 4 eval harness left for a follow-up).
- **Accuracy:** Retrieval is decided every turn (`GroundingDecider`, fails open). `FAST` no longer skips search — it only selects `OLLAMA_MODEL_FAST`. Search failures surface an explicit error instead of hallucinating from parametric memory.
- **Search:** Pluggable `services/search/` with **SearxNG primary** + DDGS failover, ranking/dedupe/rumour filtering, numbered dated source blocks, citations persisted on `Prompt.citations` and emitted as `{"v":1,"type":"citations",...}` after stream end.
- **Models:** Role-scoped `OLLAMA_MODEL_THINKING` / `_FAST` / `_UTILITY` / `OLLAMA_EMBED_MODEL=nomic-embed-text`, configurable `num_ctx`, real model name on `PromptMetric`, `reindex_embeddings` management command + loud embedding-dimension mismatch.

## SearxNG (ops)
See README **SearxNG** section. Short version: run `searxng/searxng` on the GPU host, enable `json` in `settings.yml`, set `SEARXNG_BASE_URL=http://10.0.0.128:8080` in prod/beta secrets, open `:8080` on the LAN firewall like Ollama.

## Test plan
- [x] `SKIP_RAG_INIT=1 python manage.py test chat_backend.tests` — 442 OK (6 skipped)
- [ ] Deploy beta with updated secrets (`OLLAMA_MODEL_*`, `OLLAMA_EMBED_MODEL=nomic-embed-text`, `SEARXNG_BASE_URL`)
- [ ] After embed change: `python manage.py reindex_embeddings`
- [ ] Verify `did Taylor Swift get married` in FAST and THINKING returns grounded answer with citations frame
- [ ] Kill SearxNG and confirm factual turns return search_unavailable (not Joe Alwyn hallucination); non-factual chat still worksReviewed-on: #65

.env.example

@@ -12,8 +12,22 @@ DATABASE_URL=postgres://chat_backend:chat_backend@db:5432/chat_backend
 
 # Ollama — local loopback when Ollama runs on this machine; LAN IP for GPU host.
 OLLAMA_BASE_URL=http://127.0.0.1:11434
-# OLLAMA_MODEL=llama3.2
-# OLLAMA_EMBED_MODEL=llama3.2
+# Legacy fallback (used when role-specific vars unset). Prefer the role vars.
+# OLLAMA_MODEL=gpt-oss:20b
+# OLLAMA_MODEL_THINKING=gpt-oss:20b
+# OLLAMA_MODEL_FAST=gemma4:latest
+# OLLAMA_MODEL_UTILITY=llama3.2
+# OLLAMA_EMBED_MODEL=nomic-embed-text
+# OLLAMA_NUM_CTX_THINKING=16384
+# OLLAMA_NUM_CTX_FAST=8192
+# OLLAMA_NUM_CTX_UTILITY=4096
+
+# Web search (#62) — SearxNG primary, DDGS failover. See README "SearxNG".
+ALLOW_INTERNET_ACCESS=true
+SEARCH_PROVIDER=searxng
+SEARCH_FAILOVER_PROVIDER=ddgs
+SEARXNG_BASE_URL=http://127.0.0.1:8088
+# SEARXNG_TIMEOUT_SECONDS=8
 
 # Email (SMTP2GO) — optional for local
 EMAIL_HOST=mail.smtp2go.com