fix(scripts): update.sh now appends vars missing from .env, not just blank ones

set_if_blank/mint_key_if_blank used sed -i "s|^KEY=.*|...|", which only
replaces an existing KEY= line — a no-op if the line isn't there at all.
Any .env created before a var was added to .env.example (SEARXNG_LAN_IP,
PGVECTOR_DB_PASSWORD, MEMORY_RETRIEVAL_*, etc.) silently never got that var
filled in. Both helpers now check for "line missing" as a third case and
append it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/update.sh

@@ -13,13 +13,19 @@ cd "$(dirname "$0")/.."
 
 [ -f .env ] || cp .env.example .env
 
+# Handles all three cases: the KEY=value line is missing entirely (.env
+# predates that var being added to .env.example — sed can't fix what isn't
+# there, so this appends it), present but blank, or already set.
 set_if_blank() {
   local key="$1" value="$2"
   if grep -qE "^${key}=.*[^[:space:]]" .env; then
     echo "${key}: already set, skipping."
-  else
+  elif grep -qE "^${key}=" .env; then
     sed -i "s|^${key}=.*|${key}=${value}|" .env
     echo "${key}: set."
+  else
+    echo "${key}=${value}" >> .env
+    echo "${key}: added (was missing from .env)."
   fi
 }
 
@@ -77,7 +83,12 @@ mint_key_if_blank() {
     -H "Content-Type: application/json" \
     -d "{\"key_alias\": \"${alias}\"}" | jq -r '.key')
   if [ -n "$minted" ] && [ "$minted" != "null" ]; then
+    # Same missing-line-vs-blank-line handling as set_if_blank above.
+    if grep -qE "^${key}=" .env; then
       sed -i "s|^${key}=.*|${key}=${minted}|" .env
+    else
+      echo "${key}=${minted}" >> .env
+    fi
     echo "${key}: minted."
   else
     echo "${key}: mint failed, create it by hand per docs/proxy-key-onboarding.md."