feat(searxng): route search egress through the esh-scale SOCKS5 proxy

Committing work deployed on 2026-09-17 that had been left uncommitted, so
canonical intent stops disagreeing with the running host. The deployed
/opt/docker/conf/searxng/searxng-settings.yml is byte-identical to the
canonical file here, verified before this commit.

Search requests and their DNS now exit via socks5h://10.0.50.65:1080 on
esh-scale (CT 108), an application-level proxy rather than a host-wide exit
node; no route or firewall changes. microsocks runs as nobody under
searxng-egress.service, binds only 10.0.50.65:1080, and bypasses SOCKS auth
for source 10.100.50.40 alone — every other source must supply a password
regenerated at each start and never distributed. Verified active and enabled.

There is deliberately no direct-NH3 fallback: an ESH outage must fail the
search rather than silently revert egress.

⚠ THE CHANGE HAS NOT ACHIEVED ITS PURPOSE AS DEPLOYED. Two independent live
queries, 2026-09-18, both report brave "Suspended: too many requests",
duckduckgo "CAPTCHA" and startpage "Suspended: CAPTCHA", leaving google cse
as the only answering engine. Moving egress off NH3's residential address is
what this change did, and CAPTCHA avoidance was the stated reason searxng sits
at NH3 at all. The README anticipated the risk in its Dependency note; it has
materialised. Rollback procedure is in the README and the pre-change config is
kept on the host as searxng-settings.yml.pre-esh-20260917.

Measured egress also drifted from the value recorded at cutover: the README
notes 154.50.58.126, the proxy now exits 128.177.138.182. Expected — the README
pins no public IP and calls out WAN failover — but recorded here so the number
in the doc is not mistaken for current.

Also retargets seat-inventory.py's default host from the mesh address
100.64.0.7 to fv-ml1's LAN address 10.251.50.54, routed by the site gateway.

stacks/searxng/conf/searxng-settings.yml

@@ -3,10 +3,9 @@
 # ⚠ WHY NH3 AND NOT THE COLO. Measured 2026-09-03:
 #     ana-docker egress  38.120.12.42   (datacenter) -> DuckDuckGo + Startpage CAPTCHA
 #     nh3-docker egress  70.230.226.88  (residential) -> no CAPTCHA
-#   Search engines gate datacenter ranges. Same reason the fleet keeps a
-#   residential SOCKS5 egress proxy on nh3-dev for yt-dlp. Running the search
-#   aggregator from a residential-egress site removes the problem at the source
-#   rather than proxying around it.
+# Since 2026-09-17, search requests exit via a restricted SOCKS5 listener on
+# esh-scale (10.0.50.65:1080), per operator request. Hosting remains at NH3.
+# No host default-route or mesh routing changes. See stacks/searxng/README.md.
 
 use_default_settings:
   engines:
@@ -72,8 +71,8 @@ outgoing:
   pool_connections: 100
   pool_maxsize: 20
   enable_http2: true
-  # No proxy needed: this host already egresses residentially (see header).
-  # If that ever changes, the fleet's NH3 SOCKS5 proxy is the fallback:
-  #   proxies:
-  #     all://:
-  #       - socks5h://10.100.10.50:1080
+  # ESH-only search egress; resolve engine hostnames at the proxy.
+  # No direct fallback: an ESH outage must not silently switch back to NH3.
+  proxies:
+    all://:
+      - socks5h://10.0.50.65:1080