Deploy SearxNG on ai-server-4080 for chat_backend grounded search (#10) (#11)

## Summary
- Closes [#10](#10).
- Deploys **SearxNG** on **ai-server-4080** (`10.0.0.128`) for [chat_backend#62](ai_ml_operations/chat_backend#62) / [PR #65](ai_ml_operations/chat_backend#65) grounded search.
- New `roles/searxng/` (compose + JSON-enabled `settings.yml`), gated by `searxng_stack: true`, wired into `site.yml`.
- **Host port 8088** (not 8080 — that is `dta_webapp` on this host). UFW allows `10.0.0.0/24` → `8088/tcp` only.

## Ops after merge

```bash
./scripts/provision.sh ai-server-4080
# or targeted:
ansible-playbook playbooks/site.yml --limit ai-server-4080 --tags never  # full site play includes searxng when searxng_stack
```

Then set in `chat_backend_prod.env` / `chat_backend_beta.env`:

```text
SEARCH_PROVIDER=searxng
SEARCH_FAILOVER_PROVIDER=ddgs
SEARXNG_BASE_URL=http://10.0.0.128:8088
```

Smoke test from any app host:

```bash
curl -sG 'http://10.0.0.128:8088/search' --data-urlencode 'q=test' -d 'format=json' | head
```

## Test plan
- [ ] Provision ai-server-4080; confirm `docker ps` shows `searxng`
- [ ] Confirm `:8088` responds with JSON; `:8080` still serves dta_webapp
- [ ] Confirm UFW rule is LAN-only
- [ ] From adama/roslin container network, curl SearxNG succeeds
- [ ] Update chat_backend secrets to `:8088` and redeploy betaReviewed-on: #11

roles/searxng/defaults/main.yml

@@ -13,8 +13,7 @@ searxng_container_port: 8080
 searxng_base_url: "http://{{ ansible_host }}:{{ searxng_host_port }}/"
 
 # Override via host_vars or vault; must be stable across restarts.
-# SearxNG expects a long random string (use >= 32 chars).
-searxng_secret_key: "change-me-searxng-secret-key-32chars"
+searxng_secret_key: "CHANGE_ME_SEARXNG_SECRET"
 
 # LAN CIDR allowed to hit the JSON API (same pattern as observability).
 searxng_ufw_from: "{{ ufw_ssh_allowed_network }}"

roles/searxng/tasks/main.yml

@@ -8,7 +8,7 @@
     state: directory
     owner: "{{ admin_user }}"
     group: "{{ admin_user }}"
-    mode: "0755"
+    mode: "0750"
 
 - name: searxng | settings.yml
   ansible.builtin.template:
@@ -16,8 +16,7 @@
     dest: "{{ searxng_dir }}/settings.yml"
     owner: "{{ admin_user }}"
     group: "{{ admin_user }}"
-    # Container runs as non-root searxng UID — must be world-readable (#10).
-    mode: "0644"
+    mode: "0640"
   register: _searxng_settings
 
 - name: searxng | compose file