searxng: wire paid Kagi engine with deploy-time key rendering

The stock SearXNG image ships a native kagi engine; enabling it needs an
API key that must never enter git, and SearXNG does not expand env vars
in settings.yml (the live secret_key literally was '${SEARXNG_SECRET}'
until now — the app tolerated the placeholder string silently).

- settings.yml: kagi engine enabled (weight 2, kg shortcut, paging off so
  exactly one API credit per aggregated query, timeout 8.0 vs 5.0 scrapers
  so a slow paid query is not a wasted credit); api_key stays ${KAGI_API_KEY}.
- new scripts/searxng-render-settings.py: deploy-time renderer, allowlisted
  to KAGI_API_KEY/SEARXNG_SECRET/SEARXNG_BASE_URL, fails the deploy loudly
  on an unresolvable placeholder, idempotent on redeploys.
- deploy-remote.sh copy_searxng_config runs the renderer against
  /opt/searxng/.env after copying settings.yml into /opt/searxng/config.
- KAGI_API_KEY placeholder added to dankclaw/.env.example (real key staged
  into the host-side /opt/searxng/.env, mode 600, out of band).
- bats: engine wiring, renderer substitution, loud-failure, deployer seam.
- docs: SearXNG.md Kagi section + renderer law; Providers.md carve-out on
  the no-credentials policy (paid engine acceptable when bounded + ordered).

Verified live on dankclaw: direct API probe via the gluetun netns (200,
data.search[] shape), then an aggregated query returned 29/29 results
tagged kagi, zero unresponsive engines.

dankclaw/.env.example

@@ -4,6 +4,11 @@
 # SearXNG
 SEARXNG_SECRET=changeme
 SEARXNG_BASE_URL=http://search.franksdank.cloud/
+# Kagi search API key (https://help.kagi.com/kagi/api/). Powers the paid
+# `kagi` engine in shared/searxng/settings.yml; deploy-remote.sh bakes it into
+# the live settings.yml via scripts/searxng-render-settings.py. The quadlet
+# does NOT pass it into the container environment.
+KAGI_API_KEY=changeme
 
 # Gluetun VPN (see https://github.com/qdm12/gluetun-wiki)
 # Single-peer WireGuard model. Fill from your provider's WireGuard config.