Deploy SearxNG on ai-server-4080 for chat_backend grounded search (#10).

Add roles/searxng (compose + JSON-enabled settings), gate with searxng_stack
on ai-server-4080, open UFW 8088/tcp from the LAN. Port 8088 avoids the
dta_webapp :8080 clash; chat_backend must use SEARXNG_BASE_URL=http://10.0.0.128:8088.

scripts/provision.sh

@@ -15,7 +15,8 @@ Provision server(s) with site.yml.
 
 Applies: common, ufw, docker, nodejs, gitea-key, tianji, alloy (every host).
 On ai-server-4080 also: observability (Loki + Prometheus + Grafana) when
-observability_stack is true in host_vars.
+observability_stack is true, and SearxNG when searxng_stack is true
+(chat_backend grounded search on :8088).
 
   HOST              Optional. Limit to one host: adama, roslin, or ai-server-4080.
                     Omit to run against all webservers.
@@ -31,7 +32,7 @@ Examples:
   $(basename "$0") adama --check    # dry run on adama only
   $(basename "$0") adama            # provision adama (includes Alloy)
   $(basename "$0") adama --ask-pass  # first SSH login before ssh-copy-id
-  $(basename "$0") ai-server-4080   # control node + Loki/Prometheus/Grafana
+  $(basename "$0") ai-server-4080   # control node + Loki/Prometheus/Grafana + SearxNG
   $(basename "$0")                  # provision all hosts
 EOF
 }