feat(agent): web.search / web.fetch via Brave Search (WEB-1)

- adapters/websearch: Brave client (X-Subscription-Token, error classes),
  result normalization with redaction/truncation, SSRF guard, HTML→text fetch
  (10s, 512KB, text/html|text/plain only)
- modules/websearch: 10-min PG cache (region websearch), cross-process
  per-minute limit, web.fetch allowlist = URLs from the caller's latest
  web.search; POST /websearch/test
- settings.agent.webSearch (key write-only → secret_ref); settings card
  under Agent; web.* offered to the model only when enabled, plus a system
  prompt rule; outputs marked untrusted
- capability count 27 → 29; e2e E13; runbook docs/runbook/websearch.md

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/test/e2e/fixtures/modules.ts

@@ -9,6 +9,7 @@ import { createBrowserModule } from "../../../src/modules/browser/index.ts";
 import { createSchedulesModule } from "../../../src/modules/schedules/index.ts";
 import { createSourcesIdentityModule } from "../../../src/modules/sources-identity/index.ts";
 import type { ServerModule } from "../../../src/modules/types.ts";
+import { createWebSearchModule, type WebSearchModuleOptions } from "../../../src/modules/websearch/index.ts";
 
 // e2e 模块装配:真实四个模块,外部依赖指向 testkit mock(qB 账号 admin/adminadmin、固定磁盘用量、按标题生成的种子)。
 // harness(API/worker 同进程)与崩溃恢复用的 worker 子进程共用这一份,保证两边行为一致。
@@ -26,6 +27,8 @@ export interface E2EModuleOptions {
   fakeScripts?: FakeScript[];
   /** 下载同步周期(毫秒) */
   syncIntervalMs?: number;
+  /** 网页搜索的 fetch / DNS 注入(E13);缺省不联网也能注册能力 */
+  webSearch?: WebSearchModuleOptions;
 }
 
 export function buildModules(o: E2EModuleOptions): ServerModule[] {
@@ -68,6 +71,8 @@ export function buildModules(o: E2EModuleOptions): ServerModule[] {
     }),
     // 浏览器能力(browser.*)随首批能力一起注册;e2e 不配置浏览器服务
     createBrowserModule(),
+    // 网页搜索(web.search / web.fetch);e2e 注入 mock 搜索服务与网页
+    createWebSearchModule(o.webSearch ?? {}),
     // 定时任务调度器(驱动上面模块登记的周期任务;须在末尾)
     createSchedulesModule({ builtinChecks: false, scheduler: { tickMs: 100, lockRetryMs: 200 } }),
   ];