SearXNG: move the trio out of compose into quadlet deployment

Remove gluetun/searxng/valkey from dankclaw/compose.yaml (they are now
quadlet units) so podman-compose up can no longer fight them for the netns and
port 8081. Add scripts/deploy-searxng-quadlet.sh: an idempotent installer that
copies the units to ~/.config/containers/systemd/, daemon-reloads, enables them
for boot, and starts them in dependency order. Safe to run on first migration
and on every later change.

dankclaw/compose.yaml

@@ -3,67 +3,13 @@
 # See ../docs/Dankclaw/ and ../docs/Infrastructure/ for service documentation.
 
 services:
-  # --- VPN tunnel: SearXNG outbound traffic only ---------------------------
-  gluetun:
-    image: docker.io/qmcgaw/gluetun:latest
-    container_name: gluetun
-    restart: always
-    cap_add:
-      - NET_ADMIN
-    devices:
-      - /dev/net/tun:/dev/net/tun
-    environment:
-      VPN_SERVICE_PROVIDER: "${VPN_SERVICE_PROVIDER}"
-      VPN_TYPE: "${VPN_TYPE}"
-      WIREGUARD_PRIVATE_KEY: "${WIREGUARD_PRIVATE_KEY}"
-      WIREGUARD_ADDRESSES: "${WIREGUARD_ADDRESSES}"
-      WIREGUARD_PUBLIC_KEY: "${WIREGUARD_PUBLIC_KEY}"
-      WIREGUARD_ENDPOINT_IP: "${WIREGUARD_ENDPOINT_IP}"
-      WIREGUARD_ENDPOINT_PORT: "${WIREGUARD_ENDPOINT_PORT}"
-      WIREGUARD_ALLOWED_IPS: "${WIREGUARD_ALLOWED_IPS}"
-      WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL: "${WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL}"
-    ports:
-      # SearXNG's published port lives on gluetun (network_mode: service:gluetun)
-      - "8081:8080"
-    healthcheck:
-      # The gluetun image has no curl, and its :8000 status server 404s on
-      # every path. Check the WireGuard tunnel interface instead: tun0 exists
-      # only while the VPN is connected, so this reflects real tunnel state.
-      test: ["CMD", "sh", "-c", "test -e /sys/class/net/tun0"]
-      interval: 60s
-      timeout: 10s
-      retries: 3
-
-  searxng:
-    image: ghcr.io/searxng/searxng:latest
-    container_name: searxng
-    restart: unless-stopped
-    network_mode: "service:gluetun"
-    depends_on:
-      - gluetun
-      - valkey
-    environment:
-      SEARXNG_SECRET: "${SEARXNG_SECRET}"
-      SEARXNG_BASE_URL: "${SEARXNG_BASE_URL}"
-    volumes:
-      - /opt/searxng/config:/etc/searxng
-    healthcheck:
-      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8080/healthz')"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-
-  valkey:
-    image: docker.io/valkey/valkey:9-alpine
-    container_name: searxng-valkey
-    restart: always
-    volumes:
-      - /opt/searxng/valkey:/data
-    healthcheck:
-      test: ["CMD", "valkey-cli", "ping"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
+  # --- SearXNG stack (gluetun + searxng + valkey) --------------------------
+  # These three services are now boot-persistent Quadlet units, not compose
+  # services. They live in searxng/quadlet/ and install to
+  # ~/.config/containers/systemd/ on the host. searxng reuses gluetun's netns
+  # (Network=gluetun.container) so its traffic exits the WireGuard tunnel.
+  # Deploy with: scripts/deploy-searxng-quadlet.sh dankclaw
+  # See ../docs/Dankclaw/SearXNG.md, Gluetun.md, Valkey.md.
 
   # --- AI image generation (CPU backend; ROCm does not support gfx1151) ----
   comfyui: