#49 · Pin SearXNG image to specific tag in compose.yml

Context

Currently uses searxng/searxng:latest (or unpinned) — a breaking upstream release will silently break community search. Pin to a date-tagged release and document the upgrade workflow.

Acceptance criteria

• [ ] compose.yml uses searxng/searxng:YYYY.MM.DD-<sha> tag
• [ ] README has "Upgrading SearXNG" section with the 4-step process
• [ ] Renovate config (renovate.json) flagged to track this image

Technical hints

• Renovate Docker manager: see https://docs.renovatebot.com/modules/manager/dockerfile/
• Date-tagged releases listed: https://hub.docker.com/r/searxng/searxng/tags

--- *Submit a merge request that says Closes #<this issue iid> in the description. On merge to main, the GitLab webhook will auto-award your bounty + the standard merge_pr (40 pts) to your scoreboard account. Email on commit must match your Authentik email.*