Container runs as non-root; mode 0640 owned by westfarn caused
PermissionError on /etc/searxng/settings.yml and a restart loop.
Also lengthen the default secret_key to >= 32 chars.
Add roles/searxng (compose + JSON-enabled settings), gate with searxng_stack
on ai-server-4080, open UFW 8088/tcp from the LAN. Port 8088 avoids the
dta_webapp :8080 clash; chat_backend must use SEARXNG_BASE_URL=http://10.0.0.128:8088.