Replace Clay with n8n, Ollama, SearXNG and browserless; add Telegram assistant

Remove the Clay role (Claude Code web UI) and its Anthropic API key.

New roles:
- ollama: local CPU LLM (qwen3:4b-instruct), internal network only
- browserless: headless Chromium for JavaScript-heavy pages
- searxng: metasearch backend for the chat web_search tool
- n8n at agent.ladkau.de: web chat (/chat), scheduled workflows,
  Telegram bot; workflows and credentials are imported from the repo

Telegram bot: Gemini 3.8 -> Gemini 3.5 -> local Qwen fallback chain,
/qwen to force the local model, /stocks and a weekday schedule
(07:30, 13:00, 17:40) for the MTE.DE / PTX.F stock report.

Also: dashboard and check-services entries for the chat, vault checks
for the new secrets (n8n, SearXNG, Gemini, Telegram, SMTP), updated
CLAUDE.md, runbooks and README.

ansible/roles/searxng/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart searxng
+  community.docker.docker_compose_v2:
+    project_src: "{{ searxng_data_dir }}"
+    state: present
+    recreate: always

ansible/roles/searxng/tasks/main.yml

@@ -0,0 +1,37 @@
+---
+- name: Create SearXNG directory
+  ansible.builtin.file:
+    path: "{{ searxng_data_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  tags: searxng
+
+- name: Deploy SearXNG settings
+  ansible.builtin.template:
+    src: settings.yml.j2
+    dest: "{{ searxng_data_dir }}/settings.yml"
+    owner: "977"
+    group: "977"
+    mode: "0640"
+  no_log: true
+  notify: Restart searxng
+  tags: searxng
+
+- name: Deploy Docker Compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ searxng_data_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart searxng
+  tags: searxng
+
+- name: Start SearXNG
+  community.docker.docker_compose_v2:
+    project_src: "{{ searxng_data_dir }}"
+    state: present
+    pull: missing
+  tags: searxng

ansible/roles/searxng/templates/docker-compose.yml.j2

@@ -0,0 +1,19 @@
+# Managed by Ansible — do not edit manually
+services:
+  searxng:
+    image: searxng/searxng:{{ searxng_version }}
+    container_name: searxng
+    restart: unless-stopped
+    environment:
+      SEARXNG_BASE_URL: "http://searxng:8080/"
+    volumes:
+      - {{ searxng_data_dir }}/settings.yml:/etc/searxng/settings.yml:ro
+    mem_limit: {{ searxng_mem_limit }}
+    networks:
+      - searxng_internal
+
+# Not exposed via Traefik. Containers that need the API join this network
+# (declared as external there) and reach it at http://searxng:8080.
+networks:
+  searxng_internal:
+    name: searxng_internal

ansible/roles/searxng/templates/settings.yml.j2

@@ -0,0 +1,24 @@
+# Managed by Ansible — do not edit manually
+use_default_settings: true
+
+general:
+  instance_name: "search"
+  enable_metrics: false
+
+server:
+  secret_key: "{{ searxng_secret_key }}"
+  # Internal use only (no public route), so the bot limiter is not needed
+  limiter: false
+  image_proxy: false
+
+search:
+  # json is required by the n8n web_search tool
+  formats:
+    - html
+    - json
+  safe_search: 0
+  autocomplete: ""
+
+outgoing:
+  request_timeout: 6.0
+  max_request_timeout: 10.0