feat(web-search): support configurable search providers

[wsp1911]

Summary

• Keep the model-facing WebSearch schema stable with query and
  num_results, while translating provider-specific request fields at
  runtime boundaries.
• Add provider-neutral request, response, and error contracts for free Exa
  MCP, Exa Search API, Tavily, and BitFun Search HTTP Protocol v1.
• Add device-local encrypted credential management and configuration paths
  for Desktop, CLI peer host, app server, and Web UI.
• Add a WebSearch settings page with provider-specific configuration,
  credential status, protocol documentation, and localized copy.
• Preserve unknown configuration extensions, omit default WebSearch values
  from persisted configuration, and fail invalid providers without fallback.
• Normalize provider results to title, URL, optional publication time, and
  optional author, with bounded responses and 60-second timeouts.

Fixes #2684

Type and Areas

Type:

Feature / bug fix / UI/UX

Areas:

Rust contracts and core, services integrations, desktop/Tauri, CLI peer host,
app server, Web UI, i18n, repository boundary checks

Motivation / Impact

WebSearch was previously tied to the hosted free Exa MCP endpoint. Users could
not select an official API service, supply their own credentials, or connect a
compatible private search endpoint.

This PR keeps the model-visible tool schema stable while allowing the runtime
host to select one of four search providers. Existing installations continue
to use free Exa MCP by default, while users can configure Exa Search API,
Tavily, or a BitFun Search HTTP Protocol v1 endpoint.

Secrets are stored in the encrypted credential vault on the execution host and
are not written to or synchronized with normal configuration. Provider errors
are normalized and surfaced directly; an unavailable or invalid provider does
not silently fall back to another service.

Verification

Passed:

• cargo test -p bitfun-services-integrations --no-default-features --features web-tools --lib web_tools::tests::
  • 7 Exa transport tests passed
• cargo test -p tool-runtime --lib web_search::tests::
  • 2 WebSearch parser tests passed before provider ownership moved
• cargo test -p bitfun-core --no-default-features --features agent-runtime,git,tools-browser-web,tools-computer-use --lib websearch_
  • 3 WebSearch contract tests passed
• cargo test --locked -p bitfun-core --no-default-features --lib service::config::manager::tests::persistence_
  • 7 configuration persistence tests passed
• pnpm run fmt:rs
• cargo fmt --check -p bitfun-core
• git diff --check
• git diff --cached --check

Not run in the final verification pass:

• Web UI test suite and type-check
• Manual WebSearch settings UI verification
• Live requests against Exa Search API or Tavily
• Remote workspace, remote control, Peer Device Mode, or Detached Dispatch
  runtime verification

Reviewer Notes

• The public tool schema remains query plus optional num_results, with a
  default of 10 and a range of 1–20.
• Provider wire contracts use maxResults where required without changing the
  model-visible schema.
• Existing configuration defaults to exa_mcp_free; no migration is required.
• Unknown provider IDs and configuration fields survive round trips for
  cross-version compatibility, but unsupported selections fail explicitly.
• BitFun Search HTTP Protocol v1 validates endpoints and managed headers,
  rejects redirects, limits response bodies, and supports no authentication,
  bearer authentication, or one custom credential header.
• Credential status always describes the current execution host.
• Remote-related command policies and adapters were updated, but those paths
  were not exercised end to end.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.