feat: add self-hosted SearXNG research mode

.env.example

@@ -20,7 +20,7 @@ AUTOMATED_OUTREACH_ENABLED=false
 # they are never copied into API responses. Connectivity tests use bounded GET
 # requests only and report outbound_calls=false (no outreach is implemented).
 # The following variables are legacy/bootstrap fallback values only.
-AI_RESEARCH_PROVIDER=
+# AI_RESEARCH_PROVIDER is set below for the primary self-hosted mode.
 # NOUS_MODEL=Hermes-4-405B
 # NOUS_BASE_URL=https://inference-api.nousresearch.com/v1
 # NOUS_ALLOWED_HOSTS=inference-api.nousresearch.com
@@ -28,11 +28,17 @@ AI_RESEARCH_PROVIDER=
 # FIRECRAWL_BASE_URL=https://api.firecrawl.dev/v2
 # FIRECRAWL_ALLOWED_HOSTS=api.firecrawl.dev
 # FIRECRAWL_API_KEY=<Firecrawl API key; secret-manager only>
-AI_RESEARCH_PROVIDER=
+# Primary no-paid-scraper mode: Nous orchestrates, internal SearXNG searches,
+# and the API's SSRF-safe crawler reads pages. No Firecrawl key is required.
+AI_RESEARCH_PROVIDER=nous_portal
 NOUS_API_KEY=
 NOUS_MODEL=Hermes-4-405B
 NOUS_BASE_URL=https://inference-api.nousresearch.com/v1
 NOUS_ALLOWED_HOSTS=inference-api.nousresearch.com
+SEARXNG_BASE_URL=http://searxng:8080
+SEARXNG_ALLOWED_HOSTS=searxng
+SEARXNG_SECRET_KEY=
+# Optional legacy fallback only; never required by self-hosted mode.
 FIRECRAWL_API_KEY=
 FIRECRAWL_BASE_URL=https://api.firecrawl.dev/v2
 FIRECRAWL_ALLOWED_HOSTS=api.firecrawl.dev