feat(litellm): wire SearXNG search, pgvector knowledgebase, and memory ingestion

- search_tools block in litellm-config.yaml (SearXNG as a first-class
  search_provider, standalone /v1/search endpoint, not a model tool) plus
  extra_hosts on the litellm service so it can resolve search.home.
- New embedding-server (nomic-embed-text-v1.5 on a second llama.cpp
  instance), pgvector-db, and litellm-pgvector services — LiteLLM's native
  knowledgebase feature has no Qdrant backend, so this is the only
  self-hosted path (docs/research/litellm-knowledgebase.md).
- vector_store_registry + local-embedding model entry in
  litellm-config.yaml, wiring it together.
- scripts/ingest-memory.sh to load data/memory.md and
  data/claude-legacy-memory.md into the knowledgebase.
- docs/memory-knowledgebase.md documenting the whole setup; data/
  gitignored (personal memory content, not meant to be committed).
- New .env vars (SEARXNG_LAN_IP, PGVECTOR_DB_PASSWORD,
  LITELLM_PGVECTOR_API_KEY, LITELLM_PGVECTOR_EMBEDDING_KEY,
  EMBEDDING_MODEL_FILE) and generate-secrets.sh support for the
  auto-generatable ones.

Resolves #22 and #23 (wayfinder map #21). Not yet verified on real
hardware — see #24.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -19,6 +19,15 @@ OPENWEBUI_LITELLM_KEY=
 # Seconds of inactivity before llama-server is stopped. 900 = 15 min.
 LAZYTAINER_INACTIVE_TIMEOUT=900
 
+# --- Embedding model (knowledgebase, see docs/memory-knowledgebase.md) ---
+EMBEDDING_MODEL_FILE=nomic-embed-text-v1.5.Q8_0.gguf
+
+# --- SearXNG web search (see docs/research/litellm-searxng-search.md) ---
+# Required — the litellm container can't resolve search.home's LAN mDNS
+# name on its own; this becomes an extra_hosts entry. Use a static
+# DHCP-reserved IP so it doesn't drift.
+SEARXNG_LAN_IP=
+
 # --- LiteLLM proxy (see docs/proxy-key-onboarding.md, docs/network-access.md) ---
 LITELLM_PORT=4000
 # Required — generate real random values before first run, e.g. `openssl rand -hex 32`.
@@ -33,3 +42,13 @@ LITELLM_DB_PASSWORD=
 # master key never has to be typed into the browser.
 UI_USERNAME=admin
 UI_PASSWORD=
+
+# --- Knowledgebase (pgvector, see docs/memory-knowledgebase.md) ---
+# Required — random values, e.g. `openssl rand -hex 32`.
+PGVECTOR_DB_PASSWORD=
+# Auth key litellm-pgvector requires on its own API (its SERVER_API_KEY).
+LITELLM_PGVECTOR_API_KEY=
+# A virtual key litellm-pgvector uses to call back into litellm for
+# embeddings — create it in the Admin UI like any other workload key
+# (see docs/proxy-key-onboarding.md), name it "litellm-pgvector".
+LITELLM_PGVECTOR_EMBEDDING_KEY=