feat(agent): web.search / web.fetch via Brave Search (WEB-1)

- adapters/websearch: Brave client (X-Subscription-Token, error classes),
  result normalization with redaction/truncation, SSRF guard, HTML→text fetch
  (10s, 512KB, text/html|text/plain only)
- modules/websearch: 10-min PG cache (region websearch), cross-process
  per-minute limit, web.fetch allowlist = URLs from the caller's latest
  web.search; POST /websearch/test
- settings.agent.webSearch (key write-only → secret_ref); settings card
  under Agent; web.* offered to the model only when enabled, plus a system
  prompt rule; outputs marked untrusted
- capability count 27 → 29; e2e E13; runbook docs/runbook/websearch.md

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/api/settings.ts

@@ -1,5 +1,10 @@
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { type GlobalSettings, type GlobalSettingsUpdate, mergeSettings } from "@umt/contracts";
+import {
+  type GlobalSettings,
+  type GlobalSettingsUpdate,
+  mergeSettings,
+  type WebSearchTestResult,
+} from "@umt/contracts";
 import { apiData } from "~/lib/api.ts";
 import { qk } from "~/lib/query-keys.ts";
 
@@ -30,3 +35,11 @@ export function useUpdateSettings() {
     },
   });
 }
+
+/** POST /websearch/test:用已保存的搜索服务 Key 实际查一次 */
+export function useTestWebSearch() {
+  return useMutation({
+    mutationFn: (body: { query?: string } = {}) =>
+      apiData<WebSearchTestResult>("/websearch/test", { method: "POST", body }),
+  });
+}