docs+check: correct DDG status, explain silent-zero semantics, credit google cse

Follow-up corrections after review:

1. DuckDuckGo is NOT fixed. The VPS fallback egress has since been flagged by
   DuckDuckGo too (HTTP 202 + challenge markers), so it reports CAPTCHA on both
   paths. The contract and script docstring now say so instead of claiming a
   fix that had already expired. It stays enabled as best-effort coverage so a
   recovery shows up as a contribution.

2. The relationship between silent zeros and the verdict is now explicit in
   both the script output and the contract: an enabled expected engine that
   contributes zero with no error is REPORTED, not fatal. Only the
   <SEARCH_CHECK_MIN_ENGINES> floor and the extraction leg fail the run. This is
   deliberate - de-duplication and query-shape make a zero non-probative.

3. Recorded that 'google cse' uses a THIRD PARTY's public search-engine id
   hardcoded in the SearXNG build, not a key we own; its quota and availability
   are outside our control, and our own free key would need a wrapper (not
   built).

VPS forward proxy is now a real service: /opt/fwd-proxy docker compose with
restart: unless-stopped, a healthy healthcheck, and Docker enabled at boot.

scripts/search-stack-check.py

@@ -174,7 +174,10 @@ def main() -> int:
         )
         if silent:
             silent_zero_all[query] = silent
-            print(f"  SILENT ZERO (enabled, no error, no results): {silent}")
+            print(
+                "  SILENT ZERO (enabled, no error, no results -- reported, "
+                f"not fatal): {silent}"
+            )
 
     print("=" * 72)
     print("Engine contribution across all queries:")
@@ -187,6 +190,11 @@ def main() -> int:
         print("SILENT-ZERO ENGINES REPORTED (no error raised, no results returned):")
         for query, names in silent_zero_all.items():
             print(f"  {query!r}: {names}")
+        print("  NOTE: a silent zero is REPORTED, not counted as a failure.  These")
+        print("  engines are expected to answer a general query, but contributing")
+        print("  nothing to one query can be legitimate (result de-duplication, or")
+        print("  an engine that only fires on certain query shapes).  Only the")
+        print(f"  <{MIN_ENGINES}-contributing-engine floor and the extraction leg fail the run.")
 
     print("-" * 72)
     print(f"EXTRACTION: scraping {EXTRACT_URL} via {FIRECRAWL_URL}/v1/scrape")