[mod] plugin: AI tab only when activated, user API key, grounding on

Three changes to the ai_summary plugin:

- The *AI Summary* preferences tab is only rendered when the plugin is
  activated in settings.yml.  An instance that does not offer AI
  summaries no longer shows an AI tab at all.  The gate is the
  administrator setting, not the user opt-out, because the per user
  on/off switch lives inside that tab -- hiding it on opt-out would
  leave no way to opt back in.

- Users can configure an API key for their own LLM server
  (ai_summary_api_key).  The administrator key is still only sent to
  base_url and the user key only to a server the user configured, so
  neither key can be captured through the other.  The setting is marked
  secret: credentials are excluded from the preferences URL, which users
  copy around to transfer or share their preferences.

- Grounding summaries on the search results is now the default; the
  extra cost of the longer prompt is moderate.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/admin/settings/settings_ai_summary.rst

@@ -27,12 +27,16 @@ configured with an ``api_key``:
      api_key: "sk-..."
      model: "llama3.2:3b"
 
-The key is sent in an ``Authorization: Bearer`` header.  There is no user
-preference for it, and it is only sent to the ``base_url`` above: a user who
-points the ``ai_summary_server`` preference at a server of their own gets no
-``Authorization`` header.  SearXNG has no indirection for secrets in
-``settings.yml``, so the file holding the key should be readable by the
-SearXNG process only.
+The key is sent in an ``Authorization: Bearer`` header and only to the
+``base_url`` above.  A user who points the ``ai_summary_server`` preference at
+a server of their own never gets the administrator's key; for such a server
+the user configures their own key in the ``ai_summary_api_key`` preference.
+SearXNG has no indirection for secrets in ``settings.yml``, so the file
+holding the key should be readable by the SearXNG process only.
+
+The *AI Summary* tab of the preferences is only shown when the plugin is
+activated in ``settings.yml`` (``active: true``); an instance that does not
+offer AI summaries does not show the tab at all.
 
 .. attention::
 
@@ -47,9 +51,14 @@ SearXNG process only.
       preferences:
         lock:
           - ai_summary_server
+          - ai_summary_api_key
           - ai_summary_model
           - ai_summary_grounding
 
+   Locking ``ai_summary_server`` and ``ai_summary_api_key`` matters most: an
+   unlocked pair lets any user of the instance make SearXNG send an
+   ``Authorization`` header of their choosing to a host of their choosing.
+
 .. _SSRF: https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
 
 .. autoclass:: searx.ai_summary.SettingsAISummary