feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

docs/Dankclaw/SearXNG.md

@@ -0,0 +1,77 @@
+# SearXNG
+
+SearXNG is a privacy-respecting metasearch engine. It aggregates results from many upstream search engines into one result set and serves both an HTML UI and a JSON API for agents.
+
+**Host:** Dankclaw — **Hostname:** `search.dankclaw.local` — **Docs:** https://docs.searxng.org
+
+## Facts (from research, primary source)
+
+| Item | Value |
+|------|-------|
+| Image | `ghcr.io/searxng/searxng:latest` (or DockerHub mirror) |
+| Port | 8081 (host, on Gluetun) → 8080 (container) |
+| Config | `/etc/searxng/settings.yml` (bind mount) |
+| Cache | Valkey (replaces Redis) — `valkey/valkey:9-alpine` |
+| Formats | `html`, `json` (agent API) |
+
+## VPN Routing (critical)
+
+All SearXNG outbound traffic exits through the Gluetun VPN container. The container attaches to Gluetun's network namespace:
+
+```yaml
+services:
+  searxng:
+    network_mode: "service:gluetun"
+    depends_on:
+      - gluetun
+```
+
+Port publishing happens on the **gluetun** service, not on searxng. See [[Gluetun]] and the knowledge base page [[VPN Routing for SearXNG]] (KB Pattern 2 is the one used here).
+
+## settings.yml Keys
+
+```yaml
+use_default_settings: true
+server:
+  secret_key: "${SEARXNG_SECRET}"   # from .env
+  base_url: "http://search.dankclaw.local/"
+  limiter: true
+  method: "POST"
+
+search:
+  default_lang: "en"
+  formats:
+    - html
+    - json
+
+valkey:
+  url: "valkey://searxng-valkey:6379/0"
+
+outgoing:
+  request_timeout: 3.0
+  max_request_timeout: 10.0
+  retries: 3
+```
+
+## Volumes
+
+| Container path | Host path (convention) |
+|----------------|------------------------|
+| `/etc/searxng` | `/opt/searxng/config` |
+| `/etc/searxng/valkey` | (valkey container data) |
+
+## Healthcheck
+
+SearXNG responds on `/healthz` with 200 when ready.
+
+## Gotchas
+
+- The JSON API is rate-limited hard by the limiter (4 per 3600s per IP for untrusted). Add the agent's IP to the trusted group in `settings.yml` if it polls.
+- `base_url` must match the public address or proxy rewrites break.
+- Keep the valkey cache container on the same podman network as searxng.
+
+## See Also
+
+- [[Dankclaw Stack]]
+- [[Gluetun]] — the VPN container
+- Knowledge base: [[VPN Routing for SearXNG]], [[SearXNG Tuning]], [[Agentic Search Best Practices]]