SearXNG docs: document quadlet boot-persistence for the trio

Update SearXNG, Gluetun, and Valkey to describe the quadlet units instead of
compose: searxng sets Network=gluetun.container, the units install to
~/.config/containers/systemd/, and scripts/deploy-searxng-quadlet.sh deploys
them. Add a Boot Persistence section to the Stack doc. Correct the Gluetun
tunnel check (the :8000 server 404s; verify tun0 instead) and note the pinned
10.89.2.0/24 subnet.

docs/Dankclaw/Gluetun.md

@@ -12,7 +12,7 @@ Gluetun is a lightweight VPN client container. It connects to a VPN provider (Wi
 | Capabilities | `NET_ADMIN` required |
 | Device | `/dev/net/tun:/dev/net/tun` |
 | Ports published | searxng's 8081 → 8080 lives here |
-| Healthcheck | internal on `8000` (built-in) |
+| Tunnel check | the `tun0` interface exists (the `:8000` server 404s on all paths) |
 
 ## Required Environment
 
@@ -39,15 +39,19 @@ Warning from the wiki: do NOT set `DNS_UPSTREAM_PLAIN_ADDRESSES` to a LAN/bridge
 
 ## Attaching a Container
 
-```yaml
-services:
-  searxng:
-    network_mode: "service:gluetun"
-    depends_on:
-      - gluetun
+The searxng unit reuses gluetun's network namespace:
+
+```ini
+[Container]
+ContainerName=searxng
+Network=gluetun.container
 ```
 
-There is no need for `depends_on` for the network stack, but it orders startup cleanly.
+`Network=gluetun.container` also adds a systemd dependency on gluetun, so searxng starts after the tunnel.
+
+## Boot Persistence
+
+gluetun runs as the `gluetun` quadlet unit (see [[SearXNG]] for the full trio). It sets `WantedBy=default.target` and user linger is on, so the tunnel starts at boot. The WireGuard credentials live in `/opt/searxng/.env` (mode 0600). Deploy with `scripts/deploy-searxng-quadlet.sh dankclaw`.
 
 ## Verify the Tunnel