docs: record live SearXNG provider baseline

docs/Dankclaw/SearXNG Providers.md

@@ -230,6 +230,39 @@ gateway.
 > containers/systemd/<unit>.container` `Environment` to inject names into the
 > tunnel's `/etc/hosts`.
 
+## Observed Dankclaw baseline (2026-08-25)
+
+The read-only audit found:
+
+- SearXNG image: `ghcr.io/searxng/searxng:latest`; embedded version `1.0.0`.
+- Gluetun uses `VPN_SERVICE_PROVIDER=custom` with a static WireGuard profile;
+  no `SERVER_COUNTRIES`, `SERVER_CITIES`, `SERVER_REGIONS`, or
+  `SERVER_HOSTNAMES` filters are configured.
+- The observed exit was `149.22.88.19` (Seattle, Washington, US).
+- Bing and DuckDuckGo returned results. Mojeek returned no results without an
+  upstream error.
+- `google cse` and Brave were suspended for too many requests; Startpage was
+  suspended for CAPTCHA; Qwant returned CAPTCHA. SearXNG logs also recorded
+  Google's "unusual traffic from your network" response.
+- `/healthz` returned `200 OK`; the SearXNG service and Gluetun service were
+  healthy. This isolates the primary failures to upstream provider handling,
+  not application availability.
+
+This deployment returns the legacy array form for `unresponsive_engines`:
+
+```json
+"unresponsive_engines": [
+  ["brave", "Suspended: too many requests"],
+  ["startpage", "Suspended: CAPTCHA"]
+]
+```
+
+Do not assume the newer object form (`engine`, `error_type`, `suspended`)
+until the live response has been checked. The direct published port is the
+useful diagnostic path because it exercises the ProtonVPN exit. The Caddy
+hostname resolved to the WAN address during the audit and timed out from the
+audit host, so it was not used as the baseline path.
+
 ## Fix D — Verify an engine is unblocked
 
 Three layers, cheapest first. All queries should hit the path production uses
@@ -246,11 +279,11 @@ curl -s "$BASE/search?q=test&engines=google&format=json" \
 
 Inspect:
 - `content[].engine` — which engine produced each result.
-- `unresponsive_engines[]` — `{engine, error_type, suspended}`. `error_type`
-  tells you *why* (`SearxEngineTooManyRequests`, `SearxEngineCaptcha`,
-  `timeout`, `SearxEngineAccessDenied`); `suspended: true` = auto-banned right
-  now.
-- `timings[].engine` — per-engine latency.
+- `unresponsive_engines[]` — inspect the live shape first. On Dankclaw it is
+  `[engine, message]`, for example `["google cse", "Suspended: too many requests"]`.
+  Newer builds may return objects containing `engine`, `error_type`, and
+  `suspended`.
+- `timings[].engine` — per-engine latency when the running build emits timings.
 
 Full status check (bash + jq):