feat(agent): web.search / web.fetch via Brave Search (WEB-1)

- adapters/websearch: Brave client (X-Subscription-Token, error classes),
  result normalization with redaction/truncation, SSRF guard, HTML→text fetch
  (10s, 512KB, text/html|text/plain only)
- modules/websearch: 10-min PG cache (region websearch), cross-process
  per-minute limit, web.fetch allowlist = URLs from the caller's latest
  web.search; POST /websearch/test
- settings.agent.webSearch (key write-only → secret_ref); settings card
  under Agent; web.* offered to the model only when enabled, plus a system
  prompt rule; outputs marked untrusted
- capability count 27 → 29; e2e E13; runbook docs/runbook/websearch.md

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/modules/index.ts

@@ -11,6 +11,7 @@ import { searchModule } from "./search/index.ts";
 import { sourcesIdentityModule } from "./sources-identity/index.ts";
 import { systemModule } from "./system/index.ts";
 import type { ServerModule } from "./types.ts";
+import { webSearchModule } from "./websearch/index.ts";
 
 export type * from "./types.ts";
 
@@ -29,6 +30,7 @@ export const SERVER_MODULES: readonly ServerModule[] = [
   searchModule,
   browserModule,
   mcpModule,
+  webSearchModule,
   cacheModule,
   systemModule,
 ];