Reject malformed search bodies and report unranked candidates

SearXNG now requires a results array and Brave requires "type": "search"
with a results array in any web object, so `{}` is ErrSearchResponse
instead of an empty search. Rank no longer drops failed candidates: it
returns the ranked ones with ErrCandidatesUnranked joined with each
unranked candidate's URL and reason, or ErrNoUsableRecipe when none rank.
Adds an HTTPS ranking test through the SSRF-safe Fetcher.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -248,15 +248,21 @@ automatic** (D-021).
   key decrypted from `recipe_search_settings.api_key_ct`
   (`recipes.NewSearchProvider`). Redirects are not followed; 401/403 is
   `ErrSearchRefused`, 429 `ErrSearchRateLimited`, other non-2xx a
-  `SearchStatusError`, and a body that is not the provider's JSON, over
-  1 MB or with a result lacking an absolute http(s) URL `ErrSearchResponse`.
+  `SearchStatusError`, and a body that is not the provider's JSON (SearXNG
+  without a `results` array; Brave without `"type": "search"` or with a
+  `web` object lacking `results` — Brave omits `web` when nothing matched),
+  over 1 MB or with a result lacking an absolute http(s) URL
+  `ErrSearchResponse`.
 - Ranking (`recipes.Rank`) fetches and extracts the top 5 candidates
   concurrently, rejects any whose recipe lacks ingredients or an image, and
   orders the rest by the token similarity of the recipe's title to the dish
   name (`harness.Similarity`, 0–1) plus a quarter for each of ingredients,
-  image, steps and total minutes; ties keep search order. When every
-  candidate is rejected the error is `ErrNoUsableRecipe` joined with each
-  reason.
+  image, steps and total minutes; ties keep search order. No unranked
+  candidate is dropped silently: when some are ranked, they are returned
+  with `ErrCandidatesUnranked`; when none are, the error is
+  `ErrNoUsableRecipe`. Either is joined with each unranked candidate's URL
+  and reason (fetch failure, no valid recipe, missing ingredients or
+  image), so the caller decides per item what a failure means.
 - Photos are cached locally (`photos`) and processed with
   `golang.org/x/image`.