Add roles/searxng (compose + JSON-enabled settings), gate with searxng_stack on ai-server-4080, open UFW 8088/tcp from the LAN. Port 8088 avoids the dta_webapp :8080 clash; chat_backend must use SEARXNG_BASE_URL=http://10.0.0.128:8088.