Deploy SearxNG on ai-server-4080 for chat_backend grounded search (#10).

Add roles/searxng (compose + JSON-enabled settings), gate with searxng_stack
on ai-server-4080, open UFW 8088/tcp from the LAN. Port 8088 avoids the
dta_webapp :8080 clash; chat_backend must use SEARXNG_BASE_URL=http://10.0.0.128:8088.

roles/searxng/tasks/main.yml

@@ -0,0 +1,64 @@
+---
+# SearxNG JSON search API for chat_backend grounded retrieval.
+# Enabled on ai-server-4080 via searxng_stack: true (issue #10).
+
+- name: searxng | ensure project directory
+  ansible.builtin.file:
+    path: "{{ searxng_dir }}"
+    state: directory
+    owner: "{{ admin_user }}"
+    group: "{{ admin_user }}"
+    mode: "0750"
+
+- name: searxng | settings.yml
+  ansible.builtin.template:
+    src: settings.yml.j2
+    dest: "{{ searxng_dir }}/settings.yml"
+    owner: "{{ admin_user }}"
+    group: "{{ admin_user }}"
+    mode: "0640"
+  register: _searxng_settings
+
+- name: searxng | compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ searxng_dir }}/docker-compose.yml"
+    owner: "{{ admin_user }}"
+    group: "{{ admin_user }}"
+    mode: "0644"
+  register: _searxng_compose
+
+- name: searxng | allow JSON API from LAN
+  community.general.ufw:
+    rule: allow
+    port: "{{ searxng_host_port }}"
+    proto: tcp
+    from_ip: "{{ searxng_ufw_from }}"
+    comment: SearxNG for chat_backend grounded search
+
+- name: searxng | start stack
+  ansible.builtin.command:
+    cmd: >-
+      docker compose up -d --remove-orphans
+      {{ '--force-recreate' if (
+        _searxng_compose is changed
+        or _searxng_settings is changed
+      ) else '' }}
+    chdir: "{{ searxng_dir }}"
+  become: true
+  become_user: "{{ admin_user }}"
+  register: _searxng_up
+  changed_when: >-
+    _searxng_up.rc == 0 and (
+      'Started' in (_searxng_up.stdout | default(''))
+      or 'Recreated' in (_searxng_up.stdout | default(''))
+      or 'Created' in (_searxng_up.stdout | default(''))
+      or _searxng_compose is changed
+      or _searxng_settings is changed
+    )
+  failed_when: _searxng_up.rc != 0
+
+- name: searxng | show compose failure output
+  ansible.builtin.debug:
+    msg: "{{ _searxng_up.stderr_lines | default(_searxng_up.stdout_lines) }}"
+  when: _searxng_up is failed