orion: pin sift 429f6b2 (P3) and drop SearXNG WARNING logs

Sift P3 ships with sources off. SearXNG engine WARNING lines include
q=; LogLevelMax=err keeps those out of the journal. Brave scraper
stays disabled. Do not enable search sources in this commit.

flake.lock

@@ -446,16 +446,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1790189499,
-        "narHash": "sha256-iBulH/GVjue0QkaTQIfg0b90vlTirlUrS1yL8D8Czts=",
+        "lastModified": 1790191351,
+        "narHash": "sha256-XJhq+BEccNUP8FLnpkuZhrxDqhW+Yq9uXmN9Pf0MESQ=",
         "ref": "refs/heads/master",
-        "rev": "3687636ed714cc559ed5f5b87025219222bf3aa2",
-        "revCount": 31,
+        "rev": "429f6b207eab4bb480f21ca5dd9caafb6b55e9d5",
+        "revCount": 34,
         "type": "git",
         "url": "ssh://git@git.wntrmute.dev/kyle/sift"
       },
       "original": {
-        "rev": "3687636ed714cc559ed5f5b87025219222bf3aa2",
+        "rev": "429f6b207eab4bb480f21ca5dd9caafb6b55e9d5",
         "type": "git",
         "url": "ssh://git@git.wntrmute.dev/kyle/sift"
       }

flake.nix

@@ -23,7 +23,7 @@
     tracker.url = "git+https://git.wntrmute.dev/kyle/tracker";
     tracker.inputs.nixpkgs.follows = "nixpkgs";
 
-    sift.url = "git+ssh://git@git.wntrmute.dev/kyle/sift?rev=3687636ed714cc559ed5f5b87025219222bf3aa2";
+    sift.url = "git+ssh://git@git.wntrmute.dev/kyle/sift?rev=429f6b207eab4bb480f21ca5dd9caafb6b55e9d5";
     sift.inputs.nixpkgs.follows = "nixpkgs";
 
     tether.url = "git+ssh://git@git.wntrmute.dev/kyle/tether?rev=c89894b8dcac89aaea9ad72529524c1204884bc0";

hw/orion/default.nix

@@ -31,6 +31,7 @@
         engines = [
           { name = "bing"; disabled = false; }
           { name = "braveapi"; api_key = "$BRAVE_API_KEY"; disabled = false; inactive = false; }
+          # Scraper logs full q= into the journal on HTTP failures; braveapi covers it.
           { name = "brave"; disabled = true; }
           { name = "duckduckgo"; disabled = true; }
           { name = "startpage"; disabled = true; }
@@ -45,6 +46,10 @@
       };
     };
 
+    # Python WARNING logs from engines include the query string. Restricted
+    # callers must not land q= in a journal fleet logins can read.
+    systemd.services.searx.serviceConfig.LogLevelMax = "err";
+
     # searx-init loads EnvironmentFile at spawn. The file must exist before
     # systemd starts that unit. activationScripts run after users/groups and
     # before units, so the first boot/switch cannot race.