feat(pi-web-search): 搜索凭据迁移到 Pi auth.json

三个搜索 key 改为 auth.json 中的 tavily/exa/keenable api_key 凭据，
pi-web-search/auth.ts 复刻上游 resolve-config-value 语义（!command、
$VAR 插值、credential env 优先、$$/$! 转义）并在每次调用时读取，
进程环境变量与 search.env 不再被直接读取。search_config.sh 重写为
scripts/search-auth.mjs 的薄封装：加锁原子写、权限 600、保留其他
凭据条目，支持 --migrate 从旧 search.env 一次性导入。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-web-search/clients/tavily.ts

@@ -1,8 +1,10 @@
 /**
  * Tavily REST client: POST https://api.tavily.com/search|extract with a Bearer
- * key. Requires TAVILY_API_KEY — there is no keyless tier.
+ * key from auth.json (`tavily` api_key credential) — there is no keyless tier.
  */
 
+import { getSearchApiKey } from "../auth.ts";
+
 export class TavilyError extends Error {}
 
 const TAVILY_BASE_URL = "https://api.tavily.com";
@@ -30,8 +32,8 @@ export interface TavilySearchResult {
 	[key: string]: unknown;
 }
 
-export function tavilyAvailable(env: Record<string, string | undefined> = process.env): boolean {
-	return Boolean(env.TAVILY_API_KEY?.trim());
+export function tavilyAvailable(resolve: (provider: "tavily") => string | undefined = getSearchApiKey): boolean {
+	return Boolean(resolve("tavily"));
 }
 
 function withTimeout(signal: AbortSignal | undefined, timeoutMs: number): AbortSignal {
@@ -46,9 +48,9 @@ async function post(
 	signal: AbortSignal | undefined,
 	fetchImpl: FetchLike,
 ): Promise<Record<string, unknown>> {
-	const apiKey = process.env.TAVILY_API_KEY?.trim();
+	const apiKey = getSearchApiKey("tavily");
 	if (!apiKey) {
-		throw new TavilyError("Tavily is not configured: TAVILY_API_KEY is missing.");
+		throw new TavilyError('Tavily is not configured: no "tavily" api_key credential in auth.json.');
 	}
 	let response: Response;
 	try {