SearXNG: add limiter.toml trusted group (LAN /24), wire into deploy

The trusted group lives in limiter.toml, not settings.yml. Add
shared/searxng/limiter.toml trusting 192.168.0.0/24 in pass_ip and
trusted_proxies, copy it into /opt/searxng/config on deploy, and correct
the SearXNG doc. New test seam: tests/searxng_limiter.bats.

shared/searxng/limiter.toml

@@ -0,0 +1,43 @@
+# SearXNG limiter / bot-detection config.
+# Deployed to /opt/searxng/config/limiter.toml on Dankclaw (mounted at
+# /etc/searxng/limiter.toml). Loaded when server.limiter: true in settings.yml.
+#
+# The "trusted group" lives HERE, not in settings.yml.
+# Docs: https://docs.searxng.org/admin/searx.limiter.html
+
+[botdetection]
+
+# Number of leading bits compared to group addresses into a (client) network.
+ipv4_prefix = 32
+ipv6_prefix = 48
+
+# If the request IP is in trusted_proxies, the real client IP is read from the
+# X-Forwarded-For / X-Real-IP headers (set by the Caddy reverse proxy).
+trusted_proxies = [
+  '127.0.0.0/8',
+  '::1',
+  '192.168.0.0/24',
+]
+
+[botdetection.ip_limit]
+
+# Link-local addresses (fe80::/10, 169.254.0.0/16) are not monitored.
+filter_link_local = false
+
+# link_token: per-session URL bypass token. Keep off.
+link_token = false
+
+[botdetection.ip_lists]
+
+# ip_lists outranks every other method: an IP in pass_ip gets unrestricted
+# access and is not checked by user-agent or other bot detection.
+# The whole homelab LAN is trusted.
+pass_ip = [
+  '192.168.0.0/24',
+]
+
+# Blocklist (none).
+block_ip = []
+
+# Keep the SearXNG org passlist (e.g. check.searx.space) enabled.
+pass_searxng_org = true