SearXNG: define the gluetun+searxng+valkey trio as quadlet units

Converts the podman-compose SearXNG stack to boot-persistent quadlet units so
it survives a reboot (the compose deployment did not). searxng sets
Network=gluetun.container, which makes it reuse gluetun's network namespace so
outbound search traffic exits the WireGuard tunnel; it publishes no port of its
own (the port lives on gluetun). gluetun and valkey join a pinned searxng
network (10.89.2.0/24, DNS-enabled) so searxng reaches valkey by name.

Secrets stay in /opt/searxng/.env (mode 0600), referenced via [Service]
EnvironmentFile= so ${VAR} expands. Adds a bats seam asserting the netns
wiring, port placement, boot install, and that no secret material is tracked.

shared/searxng/limiter.toml

@@ -25,6 +25,7 @@ trusted_proxies = [
   '192.168.0.0/24',
   '10.88.0.0/24',
   '10.89.1.0/24',
+  '10.89.2.0/24',
 ]
 
 [botdetection.ip_limit]