fix(installer): start SearXNG for web search and Perplexica, not only --recommended

[Dario-PC-and-Gaming]

Summary

• SearXNG was gated only by --recommended / -Recommended, so -NoRecommended with Perplexica (or Hermes/OpenClaw) still on left Open WebUI pointing at http://searxng:8080 while the container was never started. Chat then failed with Failed to resolve 'searxng'.
• Start SearXNG when any of recommended, Perplexica, Hermes, or OpenClaw is enabled. Set ENABLE_WEB_SEARCH from that same flag so Core Only does not show a dead web-search toggle.
• Interpolate ENABLE_WEB_SEARCH in docker-compose.base.yml instead of hardcoding "true".

AI Assistance

Cursor drafted the installer/compose/test changes. I reproduced the bug on a Windows AMD install (-NoRecommended -NoHermes with default Perplexica on), reviewed the diff, and chose the validation below.

Release Lane

• Mainline change targeting main

Changed Surface

• Installer / bootstrap / lifecycle
• Docker Compose / service manifests
• Tests only

Risk And Validation

• Risk level: High (installer phases, Windows installer, macOS installer, base compose)
• Validation run:
  • git diff --check
  • Focused tests listed below
  • Release-grade fleet or scoped hardware validation
  • Not required because: no live reinstall of this branch; behavior is covered by installer contracts and Windows service-plan assertions. Hardware fleet is unchanged.

Commands/results:

bash -n installers/phases/03-features.sh installers/phases/06-directories.sh \
  installers/macos/install-macos.sh installers/macos/lib/env-generator.sh \
  tests/contracts/test-installer-contracts.sh tests/test-windows-service-plan.sh
# SYNTAX_OK

PowerShell parser on service-plan.ps1, env-generator.ps1, 06-directories.ps1
# PARSE OK

Windows PowerShell 5.1: New-ODSWindowsServicePlan assertions
# Core disables SearXNG/LiteLLM
# Full enables SearXNG
# Deep research without recommended enables SearXNG, leaves LiteLLM off
# Hermes-only and OpenClaw-only enable SearXNG
# SERVICE_PLAN_OK

bash tests/test-windows-service-plan.sh
# 20 passed, 0 failed (pwsh runtime block skipped in Git Bash PATH; assertions run above)

git diff --check
# clean

Operational Change Check

• This is an operational change and validation is recorded above.

Notes For Reviewers

• Out of scope: Open WebUI RAG embeddings / TEI. Web search still needs embeddings:80 (or an Open WebUI bypass) to attach sources; that is a separate concern.
• Existing Open WebUI ConfigVars can persist ENABLE_WEB_SEARCH after first boot; this PR fixes new installs and compose interpolation for .env.
• Rollback: revert the commit; Core Only / --no-recommended behavior returns to gating SearXNG only on recommended.