feat(agent): web.search / web.fetch via Brave Search (WEB-1)

- adapters/websearch: Brave client (X-Subscription-Token, error classes),
  result normalization with redaction/truncation, SSRF guard, HTML→text fetch
  (10s, 512KB, text/html|text/plain only)
- modules/websearch: 10-min PG cache (region websearch), cross-process
  per-minute limit, web.fetch allowlist = URLs from the caller's latest
  web.search; POST /websearch/test
- settings.agent.webSearch (key write-only → secret_ref); settings card
  under Agent; web.* offered to the model only when enabled, plus a system
  prompt rule; outputs marked untrusted
- capability count 27 → 29; e2e E13; runbook docs/runbook/websearch.md

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/components/settings/agent.tsx

@@ -1,10 +1,11 @@
 import { AgentToolsBlock } from "./agent-tools.tsx";
+import { WEBSEARCH_CARD } from "./agent-websearch.tsx";
 import { PiUpstreamsBlock } from "./pi-upstreams.tsx";
 import type { FieldValue } from "./resource-section.tsx";
 import { num, str } from "./resource-section.tsx";
 import { type CardSpec, n, SettingsCard, SettingsGate } from "./settings-card.tsx";
 
-// Agent 分区:上游(pi_upstream)+ 上下文与子代理(pi)+ 预算(budget.agent* 与单次上限)+ 自动调查 + 高级
+// Agent 分区:上游(pi_upstream)+ 上下文与子代理(pi)+ 预算(budget.agent* 与单次上限)+ 自动调查 + 网页搜索 + 高级
 
 /** 可清空的数字:空串 → null */
 const nullNum = (v: FieldValue | undefined) => (str(v) === "" ? null : Number(str(v)));
@@ -218,6 +219,7 @@ export function AgentSection() {
             <SettingsCard section="agent" spec={RUNTIME_CARD} settings={s} />
             <SettingsCard section="agent" spec={BUDGET_CARD} settings={s} />
             <SettingsCard section="agent" spec={INVESTIGATE_CARD} settings={s} />
+            <SettingsCard section="agent" spec={WEBSEARCH_CARD} settings={s} />
             <SettingsCard section="agent" spec={ADVANCED_CARD} settings={s} />
           </>
         )}