Grounding pipeline and recipe-search settings API

recipes.Grounder ties search, fetch/extract, Rank, the photo cache and
normalize_recipe together. Ground(ctx, dishName, query) reuses a stored
source_url among the top candidates without fetching, otherwise tries the
ranked recipes best first and stores the photo, recipe, ingredients and
steps in one transaction, returning Grounded{recipe_id, photo_id, method,
minutes_total, difficulty, source_url, site_name} or a typed
*ErrUngroundable listing every reason. GroundURL grounds a pasted URL the
same way; GroundMany grounds items 3 at a time with per-item results.

PhotoCache is split into DownloadPhoto (fetch, decode, size check, no
writes) and CachePhoto(ctx, tx, photo), which records the row in the
caller's transaction; RemovePhotoFiles cleans up after a rollback.

Migration 0007 adds photo_id, method, difficulty and minutes_total to
recipes, and api_key_last4 to recipe_search_settings. SearXNG is now
called at recipe_search_settings.base_url.

GET/PATCH /api/v1/settings/recipe-search (Brave key sealed with
secretbox, only api_key_set and api_key_last4 returned) and POST
/api/v1/settings/recipe-search/test (searches "chicken tikka masala",
returns the count, 409 not_configured or 502 search_failed).

Maestro task 53afd59c-6c35-4af7-904c-6c167d1ad69d.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/db/settings.sql.go

@@ -109,7 +109,7 @@ func (q *Queries) GetIntegrationsGoogle(ctx context.Context) (IntegrationsGoogle
 }
 
 const getRecipeSearchSettings = `-- name: GetRecipeSearchSettings :one
-SELECT id, provider, base_url, api_key_ct, created_at, updated_at FROM recipe_search_settings
+SELECT id, provider, base_url, api_key_ct, created_at, updated_at, api_key_last4 FROM recipe_search_settings
 WHERE id = 1
 `
 
@@ -124,6 +124,7 @@ func (q *Queries) GetRecipeSearchSettings(ctx context.Context) (RecipeSearchSett
 		&i.ApiKeyCt,
 		&i.CreatedAt,
 		&i.UpdatedAt,
+		&i.ApiKeyLast4,
 	)
 	return i, err
 }
@@ -390,24 +391,26 @@ func (q *Queries) UpsertIntegrationsGoogle(ctx context.Context, arg UpsertIntegr
 
 const upsertRecipeSearchSettings = `-- name: UpsertRecipeSearchSettings :one
 INSERT INTO recipe_search_settings (
-	id, provider, base_url, api_key_ct, created_at, updated_at
+	id, provider, base_url, api_key_ct, api_key_last4, created_at, updated_at
 ) VALUES (
-	1, ?, ?, ?, ?, ?
+	1, ?, ?, ?, ?, ?, ?
 )
 ON CONFLICT (id) DO UPDATE SET
 	provider = excluded.provider,
 	base_url = excluded.base_url,
 	api_key_ct = excluded.api_key_ct,
+	api_key_last4 = excluded.api_key_last4,
 	updated_at = excluded.updated_at
-RETURNING id, provider, base_url, api_key_ct, created_at, updated_at
+RETURNING id, provider, base_url, api_key_ct, created_at, updated_at, api_key_last4
 `
 
 type UpsertRecipeSearchSettingsParams struct {
-	Provider  string
-	BaseUrl   sql.NullString
-	ApiKeyCt  []byte
-	CreatedAt string
-	UpdatedAt string
+	Provider    string
+	BaseUrl     sql.NullString
+	ApiKeyCt    []byte
+	ApiKeyLast4 sql.NullString
+	CreatedAt   string
+	UpdatedAt   string
 }
 
 // Creates the single row (id 1) or replaces every column except id and
@@ -417,6 +420,7 @@ func (q *Queries) UpsertRecipeSearchSettings(ctx context.Context, arg UpsertReci
 		arg.Provider,
 		arg.BaseUrl,
 		arg.ApiKeyCt,
+		arg.ApiKeyLast4,
 		arg.CreatedAt,
 		arg.UpdatedAt,
 	)
@@ -428,6 +432,7 @@ func (q *Queries) UpsertRecipeSearchSettings(ctx context.Context, arg UpsertReci
 		&i.ApiKeyCt,
 		&i.CreatedAt,
 		&i.UpdatedAt,
+		&i.ApiKeyLast4,
 	)
 	return i, err
 }