feat: migrate from env vars to config.toml

- Add internal/config package with TOML parsing (BurntSushi/toml)
- Create config.example.toml documenting all settings
- Update main.go to load config via -config flag (default: config.toml)
- Environment variables remain as fallback overrides for backward compat
- Config file values are used as defaults; env vars override when set
- Add comprehensive tests for file loading, defaults, and env overrides
- Add config.toml to .gitignore (secrets stay local)

config.example.toml

@@ -0,0 +1,31 @@
+# gosearch configuration
+# Copy to config.toml and adjust as needed.
+# Environment variables are used as fallbacks when a config field is empty/unset.
+
+[server]
+# Listen port (env: PORT)
+port = 8080
+
+# HTTP timeout for engine and upstream calls (env: HTTP_TIMEOUT)
+http_timeout = "10s"
+
+[upstream]
+# URL of an upstream SearXNG instance for unported engines (env: UPSTREAM_SEARXNG_URL)
+# Leave empty to run without an upstream proxy.
+url = ""
+
+[engines]
+# Comma-separated list of engines to execute locally in Go (env: LOCAL_PORTED_ENGINES)
+# Engines not listed here will be proxied to upstream SearXNG.
+local_ported = ["wikipedia", "arxiv", "crossref", "braveapi", "qwant"]
+
+[engines.brave]
+# Brave Search API key (env: BRAVE_API_KEY)
+api_key = ""
+# Optional access token to gate requests (env: BRAVE_ACCESS_TOKEN)
+access_token = ""
+
+[engines.qwant]
+# Qwant category: "web" or "web-lite" (default: "web-lite")
+category = "web-lite"
+results_per_page = 10