Fix SearxNG crash loop: make settings.yml readable inside the container.

Container runs as non-root; mode 0640 owned by westfarn caused
PermissionError on /etc/searxng/settings.yml and a restart loop.
Also lengthen the default secret_key to >= 32 chars.

roles/searxng/defaults/main.yml

@@ -13,7 +13,8 @@ searxng_container_port: 8080
 searxng_base_url: "http://{{ ansible_host }}:{{ searxng_host_port }}/"
 
 # Override via host_vars or vault; must be stable across restarts.
-searxng_secret_key: "CHANGE_ME_SEARXNG_SECRET"
+# SearxNG expects a long random string (use >= 32 chars).
+searxng_secret_key: "change-me-searxng-secret-key-32chars"
 
 # LAN CIDR allowed to hit the JSON API (same pattern as observability).
 searxng_ufw_from: "{{ ufw_ssh_allowed_network }}"

roles/searxng/tasks/main.yml

@@ -8,7 +8,7 @@
     state: directory
     owner: "{{ admin_user }}"
     group: "{{ admin_user }}"
-    mode: "0750"
+    mode: "0755"
 
 - name: searxng | settings.yml
   ansible.builtin.template:
@@ -16,7 +16,8 @@
     dest: "{{ searxng_dir }}/settings.yml"
     owner: "{{ admin_user }}"
     group: "{{ admin_user }}"
-    mode: "0640"
+    # Container runs as non-root searxng UID — must be world-readable (#10).
+    mode: "0644"
   register: _searxng_settings
 
 - name: searxng | compose file