feat: improve SearXNG provider error handling and reliability

[EngineerProjects]

Problem

The SearXNG provider (internal/web/search/providers/searxng.go) frequently fails silently or surfaces unhelpful errors. Common failure modes:

1. JSON decode errors — Some SearXNG instances return HTML error pages (e.g. rate-limit page, maintenance page) when the format=json parameter is not honoured. json.Decoder fails with a generic parse error and no hint that HTML was returned.
2. No retry logic — A single transient network blip or a momentary SearXNG overload causes a permanent failure for that search.
3. Fixed 20s timeout — Slow or remote SearXNG instances get cut off. There is no way to configure the timeout in nexus.json.
4. Opaque error messages — Errors like "failed to decode SearXNG response: invalid character '<' …" are confusing for end-users; they don't indicate that the instance may be misconfigured.
5. enabled_engines query param misuse — When AllowedDomains is set, enabled_engines=google,bing,duckduckgo is appended, but this is a SearXNG-specific parameter that may not be supported on all instances and has nothing to do with domain filtering.

Proposed improvements

Better error detection

if ct := resp.Header.Get("Content-Type"); !strings.Contains(ct, "application/json") {
    body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
    return ProviderOutput{}, fmt.Errorf("SearXNG returned non-JSON response (%s): %s", ct, body)
}

Configurable timeout

Add Timeout int to SearXNGProvider / read from nexus.json web_search.searxng.timeout (seconds, default 20).

Retry on transient errors

Wrap the HTTP call in a simple 2-attempt retry with 500 ms back-off for 5xx responses and network errors.

Clearer user-facing errors in the Settings UI

When verification fails in WebSearchConfig.verify(), propagate a friendly message: e.g. "Could not reach SearXNG at http://localhost:8080 — is the instance running?".

Fix enabled_engines misuse

Remove the enabled_engines param from the AllowedDomains branch; it does not implement domain filtering. Domain filtering can be done via SearXNG's sitefilter if needed.

Files affected

• internal/web/search/providers/searxng.go — core provider
• internal/nexustui/ui/dialog/web_search_config.go — verification and error display
• internal/nexustui/config/ — optional: add timeout field to SearXNGConfig