Always-on grounded retrieval + role-scoped Ollama models (#62 Phases 1–3) (#65)

## Summary
- Closes Phases 1–3 of [#62](#62) (Phase 4 eval harness left for a follow-up).
- **Accuracy:** Retrieval is decided every turn (`GroundingDecider`, fails open). `FAST` no longer skips search — it only selects `OLLAMA_MODEL_FAST`. Search failures surface an explicit error instead of hallucinating from parametric memory.
- **Search:** Pluggable `services/search/` with **SearxNG primary** + DDGS failover, ranking/dedupe/rumour filtering, numbered dated source blocks, citations persisted on `Prompt.citations` and emitted as `{"v":1,"type":"citations",...}` after stream end.
- **Models:** Role-scoped `OLLAMA_MODEL_THINKING` / `_FAST` / `_UTILITY` / `OLLAMA_EMBED_MODEL=nomic-embed-text`, configurable `num_ctx`, real model name on `PromptMetric`, `reindex_embeddings` management command + loud embedding-dimension mismatch.

## SearxNG (ops)
See README **SearxNG** section. Short version: run `searxng/searxng` on the GPU host, enable `json` in `settings.yml`, set `SEARXNG_BASE_URL=http://10.0.0.128:8080` in prod/beta secrets, open `:8080` on the LAN firewall like Ollama.

## Test plan
- [x] `SKIP_RAG_INIT=1 python manage.py test chat_backend.tests` — 442 OK (6 skipped)
- [ ] Deploy beta with updated secrets (`OLLAMA_MODEL_*`, `OLLAMA_EMBED_MODEL=nomic-embed-text`, `SEARXNG_BASE_URL`)
- [ ] After embed change: `python manage.py reindex_embeddings`
- [ ] Verify `did Taylor Swift get married` in FAST and THINKING returns grounded answer with citations frame
- [ ] Kill SearxNG and confirm factual turns return search_unavailable (not Joe Alwyn hallucination); non-factual chat still worksReviewed-on: #65

.env.prod.example

@@ -32,8 +32,22 @@ WEB_PORT=8003
 
 # Ollama on GPU host (ai-server-4080). Firewall must allow 10.0.0.0/24 → :11434.
 OLLAMA_BASE_URL=http://10.0.0.128:11434
-OLLAMA_MODEL=llama3.2
-OLLAMA_EMBED_MODEL=llama3.2
+# Role-scoped models (#62). After changing OLLAMA_EMBED_MODEL, run:
+#   python manage.py reindex_embeddings
+OLLAMA_MODEL=gpt-oss:20b
+OLLAMA_MODEL_THINKING=gpt-oss:20b
+OLLAMA_MODEL_FAST=gemma4:latest
+OLLAMA_MODEL_UTILITY=llama3.2
+OLLAMA_EMBED_MODEL=nomic-embed-text
+OLLAMA_NUM_CTX_THINKING=16384
+OLLAMA_NUM_CTX_FAST=8192
+
+# Web search (#62) — self-hosted SearxNG (recommended). DDGS is automatic failover.
+ALLOW_INTERNET_ACCESS=true
+SEARCH_PROVIDER=searxng
+SEARCH_FAILOVER_PROVIDER=ddgs
+# Point at the SearxNG container/service on the LAN (see README "SearxNG").
+SEARXNG_BASE_URL=http://10.0.0.128:8088
 
 # Email (SMTP2GO)
 EMAIL_HOST=mail.smtp2go.com