Add SearXNG recipe-search sidecar to the compose stack

deploy/searxng/settings.yml enables the json format, turns off the public
limiter and bot detection (internal use only) and keeps only general web
search engines; the secret key comes from SEARXNG_SECRET in the
git-ignored deploy/secrets/searxng.env. deploy/compose.yaml adds the
searxng service (digest-pinned image, mealquest network only, no
published port, healthcheck, read-only root) and sets
MEALQUEST_SEARXNG_URL=http://searxng:8080 for mealquest.
deploy/compose.dev.yaml publishes it on 127.0.0.1:8888 for development.
RUNBOOK and .env.example document the new secret and checks.

Task 641f468b-68e9-42e2-b640-3199984cf75c.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/.env.example

@@ -10,6 +10,11 @@
 #   printf '%s\n' '<Authentik client secret>' > deploy/secrets/oidc_client_secret
 #   sudo chown 10001:10001 deploy/secrets/* && sudo chmod 600 deploy/secrets/*
 #
+# SearXNG's secret key is the exception: compose reads it itself, so it
+# stays owned by you (mode 0600). Create it after the chown above:
+#
+#   (umask 077; printf 'SEARXNG_SECRET=%s\n' "$(openssl rand -hex 32)" > deploy/secrets/searxng.env)
+#
 # deploy/compose.yaml mounts them at /run/secrets/<name> and points the
 # *_FILE variables at them.
 
@@ -62,6 +67,8 @@ MEALQUEST_SESSION_MAX=4320h
 #   Base64 of 32 random bytes; encrypts secrets at rest (AES-256-GCM).
 # MEALQUEST_OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret
 #   The Authentik provider's client secret.
+# MEALQUEST_SEARXNG_URL=http://searxng:8080
+#   The SearXNG recipe-search sidecar on the compose network.
 
 # --- Planned; not read by the service yet -------------------------------------
 #
@@ -75,6 +82,3 @@ MEALQUEST_SESSION_MAX=4320h
 # Google Calendar OAuth web client (Feature 16).
 # MEALQUEST_GOOGLE_CLIENT_ID=<client id>.apps.googleusercontent.com
 # MEALQUEST_GOOGLE_CLIENT_SECRET_FILE=/run/secrets/google_client_secret
-#
-# SearXNG recipe search sidecar on the compose network (Feature 07).
-# MEALQUEST_SEARXNG_URL=http://searxng:8080