fix(search): unblock SearXNG 403 — config + headers

SearXNG returned 403 for every query, logging
'X-Forwarded-For nor X-Real-IP header is set!'. Two fixes, both needed:

1. searxng/settings.yml was being overwritten by SearXNG's default
   config in fresh volumes. Explicitly set limiter: false,
   public_instance: false, and move secret_key to env lookup via
   ${SEARXNG_SECRET:-…}. Force a well-known JSON format list.

2. Even with the limiter off, SearXNG's bot detection still nags on
   missing forwarder headers. The Node client now sends
   X-Forwarded-For: 127.0.0.1, X-Real-IP: 127.0.0.1 and Accept: json
   deterministically. Done via a new extraHeaders option on the http
   wrapper.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/server/search/searxng.ts

@@ -96,7 +96,16 @@ export async function searchWeb(
   endpoint.searchParams.set('format', 'json');
   endpoint.searchParams.set('language', 'de');
 
-  const body = await fetchText(endpoint.toString(), { timeoutMs: 15_000 });
+  const body = await fetchText(endpoint.toString(), {
+    timeoutMs: 15_000,
+    // SearXNG's bot detection complains without these; we are the only caller
+    // and we're not a bot, so satisfy the check deterministically.
+    extraHeaders: {
+      'X-Forwarded-For': '127.0.0.1',
+      'X-Real-IP': '127.0.0.1',
+      Accept: 'application/json'
+    }
+  });
   let parsed: SearxngResponse;
   try {
     parsed = JSON.parse(body) as SearxngResponse;