feat(pi-web-search): 搜索凭据迁移到 Pi auth.json

三个搜索 key 改为 auth.json 中的 tavily/exa/keenable api_key 凭据，
pi-web-search/auth.ts 复刻上游 resolve-config-value 语义（!command、
$VAR 插值、credential env 优先、$$/$! 转义）并在每次调用时读取，
进程环境变量与 search.env 不再被直接读取。search_config.sh 重写为
scripts/search-auth.mjs 的薄封装：加锁原子写、权限 600、保留其他
凭据条目，支持 --migrate 从旧 search.env 一次性导入。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-web-search/router.ts

@@ -5,6 +5,8 @@
  * and failure fallbacks, never the routing itself.
  */
 
+import { getSearchApiKey, type SearchKeyResolver } from "./auth.ts";
+
 export type SearchProvider = "tavily" | "exa" | "keenable";
 
 export interface SearchRequest {
@@ -43,10 +45,10 @@ const PROVIDER_RULES: Record<SearchProvider, string> = {
 		"content length.",
 };
 
-/** Tavily requires a key; Exa and Keenable both work keyless. */
-export function availableProviders(env: Record<string, string | undefined> = process.env): SearchProvider[] {
+/** Tavily requires a key in auth.json; Exa and Keenable both work keyless. */
+export function availableProviders(resolve: SearchKeyResolver = getSearchApiKey): SearchProvider[] {
 	const providers: SearchProvider[] = [];
-	if (env.TAVILY_API_KEY?.trim()) providers.push("tavily");
+	if (resolve("tavily")) providers.push("tavily");
 	providers.push("exa", "keenable");
 	return providers;
 }
@@ -111,9 +113,9 @@ export async function routeSearch(
 	ctx: RouterContext,
 	cache: Map<string, SearchProvider>,
 	signal?: AbortSignal,
-	env: Record<string, string | undefined> = process.env,
+	resolve: SearchKeyResolver = getSearchApiKey,
 ): Promise<RouteDecision> {
-	const candidates = availableProviders(env);
+	const candidates = availableProviders(resolve);
 	const fallback = PROVIDER_FALLBACK_ORDER.find((provider) => candidates.includes(provider)) ?? candidates[0];
 	if (!fallback || candidates.length <= 1) {
 		return { provider: fallback ?? "keenable", routedBy: "fallback" };