SearXNG: trusted group needs Caddy XFF; trust the podman bridge

A direct hit on the published port has no X-Forwarded-For header, so the
bot-detection cannot resolve a client and returns 429. SearXNG must be
reached through Caddy (search.dankclaw.local), which sets X-Forwarded-For.
Add the podman bridge subnets to trusted_proxies so Caddy's source is
trusted for XFF extraction; note the CIDR is dynamic and should be pinned.
Verified agentic JSON search returns 26-31 relevant results via this path.

shared/searxng/limiter.toml

@@ -13,10 +13,18 @@ ipv6_prefix = 48
 
 # If the request IP is in trusted_proxies, the real client IP is read from the
 # X-Forwarded-For / X-Real-IP headers (set by the Caddy reverse proxy).
+# SearXNG must be reached through Caddy (search.dankclaw.local): a direct hit on
+# the published port has no X-Forwarded-For header, so the bot-detection cannot
+# resolve a client and rate-limits it. Caddy connects from the podman bridge, so
+# the bridge subnet must be trusted here. NOTE: rootless podman assigns the bridge
+# CIDR dynamically; pin the network (podman network create with a fixed --subnet)
+# so these entries stay stable.
 trusted_proxies = [
   '127.0.0.0/8',
   '::1',
   '192.168.0.0/24',
+  '10.88.0.0/24',
+  '10.89.1.0/24',
 ]
 
 [botdetection.ip_limit]