Decision: Meilisearch production hosting (Phase 3.5 / 10.1)

## Context
The frontend searches Meilisearch **directly** with short-lived tenant tokens from `GET /search/token` (returns `{ host, token, expiresAt }`, where host comes from `MEILISEARCH_PUBLIC_HOST`, falling back to `MEILISEARCH_HOST`). That means production Meilisearch must be reachable from browsers — a Render **private** service alone won't work for the current flow.

## Options
1. **Render public web service** running the official Meilisearch image + persistent disk, master key in env, tenant tokens as the only browser credential. Cheapest; we operate it; must trust Meilisearch's exposed surface.
2. **Meilisearch Cloud** (smallest tier): managed, public by design, tenant tokens supported natively. Slightly more spend, least ops.
3. **Proxy through the API** (`/search/proxy/*`): Meilisearch stays private; kills the direct-search latency benefit and adds API load; requires frontend fallback path to become the primary.

## Deliverable
- Pick one (recommendation: **option 2** if budget allows, else 1), record the rationale here, set `MEILISEARCH_PUBLIC_HOST` in the deployment env config, and verify the tenant-token flow + CORS from the production frontend origin.
- Feeds directly into the Phase 10 Render setup.

## Acceptance criteria
- [ ] Decision recorded with rationale
- [ ] Production search reachable from the browser with a tenant token (or proxy path implemented if option 3)
- [ ] `env.example` / deployment docs updated