refactor: migrate services from oberon to puck and extract oauth2-proxy role

Move searxng, openwebui, mcp_switchboard, and hass services from
oberon.incus to puck.incus, consolidating service host variables
accordingly. Clean up oberon to only run alloy, docker, rabbitmq,
and smtp4dev.

Extract oauth2-proxy from a searxng-specific sidecar into a
standalone reusable role with generic naming, supporting multiple
proxy instances per host via parameterized systemd units and
config directories.

Refactor searxng role to use updated templates (settings.yml.j2,
limiter.toml.j2) and integrate with the new generic oauth2-proxy
role. Add Caddy reverse proxy configurations for puck-hosted
services.

Move searxng_oauth2_proxy_version to global vars for consistency.

ansible/inventory/group_vars/all/vars.yml

@@ -38,6 +38,7 @@ rommie_rel: master
 # PyPI release version (no 'v' prefix) - https://pypi.org/project/open-webui/
 openwebui_rel: 0.8.3
 pulseaudio_module_xrdp_rel: 
+searxng_oauth2_proxy_version: 7.6.0
 
 # MCP URLs
 argos_mcp_url: http://miranda.incus:25534/mcp