SearXNG: define the gluetun+searxng+valkey trio as quadlet units

Converts the podman-compose SearXNG stack to boot-persistent quadlet units so
it survives a reboot (the compose deployment did not). searxng sets
Network=gluetun.container, which makes it reuse gluetun's network namespace so
outbound search traffic exits the WireGuard tunnel; it publishes no port of its
own (the port lives on gluetun). gluetun and valkey join a pinned searxng
network (10.89.2.0/24, DNS-enabled) so searxng reaches valkey by name.

Secrets stay in /opt/searxng/.env (mode 0600), referenced via [Service]
EnvironmentFile= so ${VAR} expands. Adds a bats seam asserting the netns
wiring, port placement, boot install, and that no secret material is tracked.

dankclaw/searxng/quadlet/searxng.container

@@ -0,0 +1,30 @@
+# Quadlet unit: SearXNG search engine (rootless, boot-persistent).
+#
+# Install path on dankclaw: ~/.config/containers/systemd/searxng.container
+# Unit name: searxng.service (container name: searxng)
+#
+# Reuses gluetun's network namespace (Network=gluetun.container) so its
+# outbound traffic exits the WireGuard tunnel. It publishes no port of its own;
+# the port lives on gluetun. It reaches valkey by name on the searxng network.
+# Config mounts from /opt/searxng/config. See docs/Dankclaw/SearXNG.md.
+
+[Unit]
+Description=SearXNG search engine container
+Wants=gluetun.service searxng-valkey.service
+After=gluetun.service searxng-valkey.service network.target
+
+[Container]
+ContainerName=searxng
+Network=gluetun.container
+Image=ghcr.io/searxng/searxng:latest
+Environment=SEARXNG_SECRET=${SEARXNG_SECRET}
+Environment=SEARXNG_BASE_URL=${SEARXNG_BASE_URL}
+Volume=/opt/searxng/config:/etc/searxng
+
+[Service]
+EnvironmentFile=/opt/searxng/.env
+TimeoutStartSec=900
+Restart=always
+
+[Install]
+WantedBy=default.target