feat(agent): web.search / web.fetch via Brave Search (WEB-1)

- adapters/websearch: Brave client (X-Subscription-Token, error classes),
  result normalization with redaction/truncation, SSRF guard, HTML→text fetch
  (10s, 512KB, text/html|text/plain only)
- modules/websearch: 10-min PG cache (region websearch), cross-process
  per-minute limit, web.fetch allowlist = URLs from the caller's latest
  web.search; POST /websearch/test
- settings.agent.webSearch (key write-only → secret_ref); settings card
  under Agent; web.* offered to the model only when enabled, plus a system
  prompt rule; outputs marked untrusted
- capability count 27 → 29; e2e E13; runbook docs/runbook/websearch.md

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/test/e2e/harness.ts

@@ -22,6 +22,7 @@ import { EventBus } from "../../src/http/sse.ts";
 import { createLogger } from "../../src/logger.ts";
 import { setDefaultUpstream } from "../../src/modules/pi/store.ts";
 import type { ServerModule } from "../../src/modules/types.ts";
+import type { WebSearchModuleOptions } from "../../src/modules/websearch/index.ts";
 import { type RunningWorker, startWorker } from "../../src/worker/index.ts";
 import { withSchemaLock } from "../auth-settings/harness.ts";
 import { buildModules } from "./fixtures/modules.ts";
@@ -78,6 +79,8 @@ export interface E2EOptions {
   /** false:只做 API/引擎客户端(崩溃恢复用例由子进程跑 worker) */
   worker?: boolean;
   tmdbFixtures?: TmdbFixture[];
+  /** 网页搜索模块注入(E13) */
+  webSearch?: WebSearchModuleOptions;
 }
 
 export async function waitFor<T>(
@@ -129,7 +132,11 @@ export async function createE2E(name: string, opts: E2EOptions = {}): Promise<E2
     NODE_ENV: "development",
   });
   const bus = new EventBus(5000);
-  const modules = buildModules({ sessionDir, ...(opts.fakeScripts ? { fakeScripts: opts.fakeScripts } : {}) });
+  const modules = buildModules({
+    sessionDir,
+    ...(opts.fakeScripts ? { fakeScripts: opts.fakeScripts } : {}),
+    ...(opts.webSearch ? { webSearch: opts.webSearch } : {}),
+  });
   const booted = await bootstrap({
     role: "all",
     config,