Add resilient DuckDuckGo result fallback for ask

[variablenix]

Summary

• add a rendered DuckDuckGo result-card fallback when Search Assist and structured providers have no answer
• fetch bounded public HTML excerpts and Reddit public JSON, with source attribution
• reject private/local destinations, unusual ports, unsafe redirects, oversized responses, and non-HTML content
• preserve existing Search Assist, Instant Answer, Wikidata, and final search-link behavior
• update ask configuration, deployment, and plugin documentation

Validation

• go test ./...
• go vet ./...
• go test -race ./plugins
• go build ./cmd/irc-bot
• git diff --check

The rendered fallback requires Chromium/Chrome when enabled; Docker already includes Chromium.