SearXNG: add limiter.toml trusted group (LAN /24), wire into deploy

The trusted group lives in limiter.toml, not settings.yml. Add
shared/searxng/limiter.toml trusting 192.168.0.0/24 in pass_ip and
trusted_proxies, copy it into /opt/searxng/config on deploy, and correct
the SearXNG doc. New test seam: tests/searxng_limiter.bats.

tests/searxng_limiter.bats

@@ -0,0 +1,48 @@
+#!/usr/bin/env bats
+# Seam: SearXNG limiter / trusted-group configuration.
+# The trusted group lives in shared/searxng/limiter.toml (NOT in settings.yml).
+# It must be valid TOML, trust the homelab LAN, and be copied into place by
+# deploy.sh so the deployed /etc/searxng/limiter.toml matches the repo.
+
+load helpers
+
+@test "shared/searxng/limiter.toml exists" {
+    [ -f "$REPO_ROOT/shared/searxng/limiter.toml" ]
+}
+
+@test "limiter.toml is valid TOML" {
+    python3 - "$REPO_ROOT/shared/searxng/limiter.toml" <<'PYEOF'
+import sys, tomllib
+with open(sys.argv[1], "rb") as fh:
+    tomllib.load(fh)
+PYEOF
+}
+
+@test "limiter.toml trusts the homelab LAN in pass_ip" {
+    python3 - "$REPO_ROOT/shared/searxng/limiter.toml" <<'PYEOF'
+import sys, tomllib
+with open(sys.argv[1], "rb") as fh:
+    data = tomllib.load(fh)
+ip_lists = data.get("botdetection", {}).get("ip_lists", {})
+pass_ip = ip_lists.get("pass_ip", [])
+assert "192.168.0.0/24" in pass_ip, f"LAN missing from pass_ip; got {pass_ip}"
+PYEOF
+}
+
+@test "limiter.toml trusts the LAN as a proxy for X-Forwarded-For" {
+    python3 - "$REPO_ROOT/shared/searxng/limiter.toml" <<'PYEOF'
+import sys, tomllib
+with open(sys.argv[1], "rb") as fh:
+    data = tomllib.load(fh)
+bd = data.get("botdetection", {})
+proxies = bd.get("trusted_proxies", [])
+assert "192.168.0.0/24" in proxies, f"LAN missing from trusted_proxies; got {proxies}"
+PYEOF
+}
+
+@test "deploy.sh copies limiter.toml into /opt/searxng/config" {
+    grep -q "shared/searxng/limiter.toml" "$REPO_ROOT/scripts/deploy.sh" \
+        || { echo "deploy.sh does not copy shared/searxng/limiter.toml"; return 1; }
+    grep -q "/opt/searxng/config/limiter.toml" "$REPO_ROOT/scripts/deploy.sh" \
+        || { echo "deploy.sh does not place limiter.toml at /opt/searxng/config"; return 1; }
+}