add interactive SearXNG safe-search prompts and category/engine controls

Setup (both scripts):
- Q6 asks safe-search level: none / moderate / strict
- Then asks which categories to disable: videos images news science social
- Then asks which engines to disable by name (duckduckgo, bing, etc.)
- Choices flow into SEARXNG_QUERY_URL &safesearch=N in docker-compose.yml
- SearXNG summary line added to laptop_full_setup.sh install plan

configure-searxng-safesearch.sh:
- Full rewrite: --disable-categories, --disable-engines, --enable-engines
- Category maps: videos / images / news / science / social engine lists
- --enable-engines overrides auto-disables (e.g. keep yandex on strict)
- Preserves existing secret key on update
- Creates settings.yml from scratch if missing (safe for setup use)
- Help flag (-h/--help)

https://claude.ai/code/session_012gDnantBmFTWZGCiKyjazx

local-ai-setup.sh

@@ -14,6 +14,7 @@ FORCE=false; NO_PULL=false
 for a in "$@"; do [[ "$a" == "--force" ]] && FORCE=true; [[ "$a" == "--no-pull" ]] && NO_PULL=true; done
 
 BASE="$HOME/docker/ai-stack"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 LOCAL_IP=$(ip route get 1.1.1.1 2>/dev/null | grep -oP 'src \K\S+' || hostname -I | awk '{print $1}')
 [[ -z "$LOCAL_IP" ]] && read -rp "Enter LAN IP: " LOCAL_IP
 
@@ -43,6 +44,31 @@ info "Base    : $BASE"
 info "IP      : $LOCAL_IP"
 info "GPU     : ${VRAM_GB}GB VRAM → $TIER"
 
+# ── SearXNG safe-search ───────────────────────────────────────────────────────
+echo ""
+echo "  SearXNG safe-search level:"
+echo "  0) None     — all results, no filtering  (default)"
+echo "  1) Moderate — filter explicit content"
+echo "  2) Strict   — block all explicit content"
+echo ""
+read -rp "  Choice [0]: " _SAFE_PICK
+case "${_SAFE_PICK:-0}" in
+    1) SEARXNG_SAFE_LEVEL="moderate"; SEARXNG_SAFE_INT=1 ;;
+    2) SEARXNG_SAFE_LEVEL="strict";   SEARXNG_SAFE_INT=2 ;;
+    *) SEARXNG_SAFE_LEVEL="none";     SEARXNG_SAFE_INT=0 ;;
+esac
+
+echo ""
+echo "  Disable search categories? (Enter to keep all)"
+echo "  Options: videos  images  news  science  social"
+read -rp "  Categories (space-separated, Enter to skip): " SEARXNG_DISABLE_CATS
+
+echo ""
+echo "  Disable specific engines? (Enter to keep defaults)"
+echo "  Web: google  bing  duckduckgo  brave  startpage  qwant  yahoo"
+read -rp "  Engines (space-separated, Enter to skip): " SEARXNG_DISABLE_ENGINES
+echo ""
+
 write_if_new() {
     local dest="$1"; local body; body=$(cat)
     if [[ ! -f "$dest" ]] || $FORCE; then
@@ -481,18 +507,11 @@ ok "requirements.txt + mcp_requirements.txt"
 # =============================================================================
 section "SearXNG Config"
 # =============================================================================
-write_if_new "$BASE/searxng/settings.yml" << SEARXNG
-use_default_settings: true
-general:
-  instance_name: "Local Search"
-server:
-  secret_key: "$(openssl rand -hex 32)"
-  limiter: false
-search:
-  safe_search: 0
-  default_lang: "en"
-  formats: [html, json]
-SEARXNG
+mkdir -p "$BASE/searxng"
+_SXARGS=("$SEARXNG_SAFE_LEVEL")
+[[ -n "$SEARXNG_DISABLE_CATS"    ]] && _SXARGS+=(--disable-categories "${SEARXNG_DISABLE_CATS// /,}")
+[[ -n "$SEARXNG_DISABLE_ENGINES" ]] && _SXARGS+=(--disable-engines    "${SEARXNG_DISABLE_ENGINES// /,}")
+BASE="$BASE" bash "$SCRIPT_DIR/configure-searxng-safesearch.sh" "${_SXARGS[@]}"
 
 # =============================================================================
 section ".env (tokens — never overwritten)"
@@ -553,7 +572,7 @@ services:
       - ENABLE_OPENAI_API=true
       - ENABLE_RAG_WEB_SEARCH=true
       - RAG_WEB_SEARCH_ENGINE=searxng
-      - SEARXNG_QUERY_URL=http://searxng:8080/search?q=<query>&format=json&safesearch=0
+      - SEARXNG_QUERY_URL=http://searxng:8080/search?q=<query>&format=json&safesearch=${SEARXNG_SAFE_INT}
       - RAG_WEB_SEARCH_RESULT_COUNT=5
       - RAG_WEB_SEARCH_CONCURRENT_REQUESTS=10
       - ENABLE_TOOL_SERVERS=true