searxng: remove captcha'd scraped engines, keep API-backed set

Measured 3/3 probes: duckduckgo/startpage CAPTCHA, brave rate-ban, wikidata
403 from this egress. Mojeek tried and also 403'd. Notes on keyed-engine
path to restore breadth recorded in the settings header.

playbooks/searxng-tierA-engines.yaml

@@ -0,0 +1,32 @@
+# SearXNG Tier A captcha fix (2026-09-18): remove scraped engine families that
+# CAPTCHA this egress (brave/duckduckgo/startpage), enable mojeek.
+# File: /opt/docker/conf/searxng/searxng-settings.yml (bind-mounted ro into the
+# container) -> restart required to take effect. Rerunnable.
+
+vars:
+  conf: /opt/docker/conf/searxng/searxng-settings.yml
+
+steps:
+  - name: Timestamped backup of current settings
+    shell: cp {{ conf }} {{ conf }}.bak-$(date +%Y%m%d-%H%M%S)
+    # Only back up while this version of the change has not been applied yet.
+    when: "! grep -q 'Tier A (v3' {{ conf }}"
+
+  - name: Install new settings
+    upload:
+      src: /tmp/searxng-tierA/searxng-settings.yml
+      dest: "{{ conf }}"
+      mode: "0644"
+    when: "! grep -q 'Tier A (v3' {{ conf }}"
+
+  - name: Restart searxng to pick up settings
+    shell: docker restart searxng
+
+verify:
+  - name: New config in place
+    shell: grep -q 'Tier A (v3' {{ conf }}
+    changed_when: "false"
+
+  - name: Container serving /healthz after restart
+    shell: sleep 8; curl -sf http://127.0.0.1:9996/healthz
+    changed_when: "false"