SearXNG: add limiter.toml trusted group (LAN /24), wire into deploy

The trusted group lives in limiter.toml, not settings.yml. Add
shared/searxng/limiter.toml trusting 192.168.0.0/24 in pass_ip and
trusted_proxies, copy it into /opt/searxng/config on deploy, and correct
the SearXNG doc. New test seam: tests/searxng_limiter.bats.

docs/Dankclaw/SearXNG.md

@@ -64,9 +64,20 @@ outgoing:
 
 SearXNG responds on `/healthz` with 200 when ready.
 
+## Trusted Group (limiter.toml)
+
+The trusted group lives in `shared/searxng/limiter.toml`, not in `settings.yml`. The `settings.yml` file only turns the limiter on. The file deploys to `/opt/searxng/config/limiter.toml`, mounted at `/etc/searxng/limiter.toml`.
+
+Two lists control access:
+
+- `pass_ip` — an IP in this list gets unrestricted access and bypasses all bot detection.
+- `trusted_proxies` — if the request IP is in this list, SearXNG reads the real client IP from `X-Forwarded-For` (set by Caddy).
+
+The whole homelab LAN `192.168.0.0/24` is in both lists. This lets local agents and browsers poll the JSON API without tripping the 4-per-hour limit. `deploy.sh` copies the file into place on each deploy.
+
 ## Gotchas
 
-- The JSON API is rate-limited hard by the limiter (4 per 3600s per IP for untrusted). Add the agent's IP to the trusted group in `settings.yml` if it polls.
+- The JSON API is rate-limited hard by the limiter (4 per 3600s per IP for untrusted). Add the agent's IP to `pass_ip` in `limiter.toml` if it polls.
 - `base_url` must match the public address or proxy rewrites break.
 - Keep the valkey cache container on the same podman network as searxng.