feat(search): Tavily + Brave behind a search-provider port; Google CSE retires

Search port + model slots wave, chunk A (owner design, 2026-09-20):
- core/search.ts: SearchHit + SearchProvider port + SearchStatus —
  pure, browser-safe; adapters arrive as injected dependencies.
- server/search.ts: Tavily + Brave adapters (wire shapes VERIFIED
  against docs.tavily.com's OpenAPI + Brave's dashboard docs — Tavily
  auth is the Bearer header, not the legacy body api_key; Brave is
  X-Subscription-Token) + engine resolution per owner decisions: a key
  ALONE activates its engine (no engine choice needed), explicit
  agent.search.engine pins the preference (both keys: Tavily first),
  a pinned engine with a missing key is honestly unavailable — no
  silent fallback, no default engine.
- Curated keys catalog: GOOGLE_SEARCH_API_KEY/GOOGLE_CSE_ID retire
  (CSE closed to new customers, dies Jan 2027 — stored values become
  preserved unknown vars); TAVILY_API_KEY (tvly- shape) + BRAVE_API_KEY
  (length guard) join. UI keys-section TOOL_IDS now derives from the
  catalog — cannot drift.
- GET /api/search: {available, engine, reason} — the honest status for
  the settings gray-out; researcher-disable semantics ride the same
  signal (Teacher stream rewires the tool onto the port).
- agent.search settings field (schema + sanitizer + strict parser);
  web.ts's WebSearchResult is now the core SearchHit (re-exported).

components/settings/keys-section.tsx

@@ -28,7 +28,7 @@
  */
 
 import { useEffect, useState } from "react";
-import { type AuthKeyStatus } from "@/src/core";
+import { AUTH_KEYS, type AuthKeyStatus } from "@/src/core";
 import { SettingsGroup, SettingsRow } from "./controls.tsx";
 
 /** One pi-ai provider with plain API-key auth (the Platform seam). */
@@ -58,7 +58,10 @@ const OPENROUTER_FALLBACK = {
 
 /** The curated tools group, pinned by id (the catalog owns the copy;
  *  these ids are the contract). */
-const TOOL_IDS = ["DEEPGRAM_API_KEY", "GOOGLE_SEARCH_API_KEY", "GOOGLE_CSE_ID"] as const;
+// The curated app-service keys, derived from the catalog (search wave,
+// 2026-09-20: the Google CSE pair retired, Tavily + Brave joined) — the
+// section can never drift from core/auth-keys.ts again.
+const TOOL_IDS = AUTH_KEYS.map((k) => k.id) as readonly string[];
 
 /** The classification that drives the section's two groups. Pure —
  *  exported for tests. */