chore(searxng): adopt the concurrent v4 work, with its dead mechanism marked

Picks up uncommitted searxng changes left by another session and makes them
truthful rather than committing them as written. The stack itself verifies
clean: canonical and live are byte-identical for both compose.yaml and
searxng-settings.yml, the container is running with zero restarts, and live
queries return 51-54 results from 5-6 engines with braveapi contributing 20
each time.

compose.yaml gains SEARXNG_BRAVE_API_KEY, which NOTHING READS. It was added on
the belief that settings.yml could pull it via `!ENV SEARXNG_BRAVE_API_KEY`;
this build has no !ENV YAML constructor, so that attempt made the file
unparseable and crash-looped the container ten times with fleet search down.
The comment claiming the variable is "consumed by settings.yml" is replaced
with what is actually true. The variable is kept, unused, in case upstream ever
gains env interpolation — a comment that lies is worse than a variable that
does nothing.

The Tier A playbook is marked superseded FOR THE SETTINGS FILE ONLY, and
scoped deliberately: its v4 design uploads a settings file carrying the !ENV
tag, which would re-break the container, so settings deployment goes through
scripts/deploy-stack.sh like every other stack. Its .env merge and
up-d-not-restart steps remain useful, as do its two warnings recording real
bugs it hit — a wholesale .env overwrite that clobbered SEARXNG_SECRET, and a
sed that inserted literal backslash-n into compose.yaml. An unscoped
"superseded" banner would have buried those; that failure mode cost an outage
earlier today.

Also folds in the regenerated graphify report.

stacks/searxng/compose.yaml

@@ -16,6 +16,16 @@ services:
       - /opt/docker/conf/searxng/searxng-settings.yml:/etc/searxng/settings.yml:ro
     environment:
       - SEARXNG_SECRET=${SEARXNG_SECRET}
+      # Brave Search API key (vault: nh3-docker/searxng-brave-api-key).
+      # ⚠ NOTHING READS THIS. It was added on the belief that settings.yml could
+      # pull it via `!ENV SEARXNG_BRAVE_API_KEY`; this build has no !ENV YAML
+      # constructor, so that attempt crash-looped the container ten times with
+      # search down fleet-wide. The loader reads only SEARXNG_SETTINGS_PATH and
+      # the entrypoint substitutes only `ultrasecretkey`. The key is therefore
+      # inline in searxng-settings.yml by operator decision. Kept here, unused,
+      # so it is ready if upstream ever gains env interpolation — remove it
+      # rather than believing the comment it replaced.
+      - SEARXNG_BRAVE_API_KEY=${SEARXNG_BRAVE_API_KEY}
       - BASE_URL=http://10.100.50.40:9996/
       - INSTANCE_NAME=SearXNG
     deploy: