Generate SearXNG secret on first boot

.env.example

@@ -31,6 +31,10 @@ LLM_HOST=localhost
 # Docker Compose overrides this to http://searxng:8080 for in-network access.
 SEARXNG_INSTANCE=http://localhost:8080
 
+# Optional SearXNG cookie/CSRF secret. If blank, Docker generates one on first boot
+# and stores it in the searxng-data volume.
+# SEARXNG_SECRET=
+
 # ============================================================
 # Database
 # ============================================================