Feature 10: Recipe grounding and photos (#78)

Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>

deploy/.env.example

@@ -10,6 +10,11 @@
 #   printf '%s\n' '<Authentik client secret>' > deploy/secrets/oidc_client_secret
 #   sudo chown 10001:10001 deploy/secrets/* && sudo chmod 600 deploy/secrets/*
 #
+# SearXNG's secret key is the exception: compose reads it itself, so it
+# stays owned by you (mode 0600). Create it after the chown above:
+#
+#   (umask 077; printf 'SEARXNG_SECRET=%s\n' "$(openssl rand -hex 32)" > deploy/secrets/searxng.env)
+#
 # deploy/compose.yaml mounts them at /run/secrets/<name> and points the
 # *_FILE variables at them.
 
@@ -62,6 +67,11 @@ MEALQUEST_SESSION_MAX=4320h
 #   Base64 of 32 random bytes; encrypts secrets at rest (AES-256-GCM).
 # MEALQUEST_OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret
 #   The Authentik provider's client secret.
+# MEALQUEST_SEARXNG_URL=http://searxng:8080
+#   The SearXNG recipe-search sidecar on the compose network. Planned; not
+#   read by the service yet. The app takes its recipe-search provider and
+#   base URL from PATCH /api/v1/settings/recipe-search; see
+#   deploy/RUNBOOK.md "Recipe search (SearXNG)".
 
 # --- Planned; not read by the service yet -------------------------------------
 #
@@ -75,6 +85,3 @@ MEALQUEST_SESSION_MAX=4320h
 # Google Calendar OAuth web client (Feature 16).
 # MEALQUEST_GOOGLE_CLIENT_ID=<client id>.apps.googleusercontent.com
 # MEALQUEST_GOOGLE_CLIENT_SECRET_FILE=/run/secrets/google_client_secret
-#
-# SearXNG recipe search sidecar on the compose network (Feature 07).
-# MEALQUEST_SEARXNG_URL=http://searxng:8080