feat(pi-web-search): 搜索凭据迁移到 Pi auth.json

三个搜索 key 改为 auth.json 中的 tavily/exa/keenable api_key 凭据，
pi-web-search/auth.ts 复刻上游 resolve-config-value 语义（!command、
$VAR 插值、credential env 优先、$$/$! 转义）并在每次调用时读取，
进程环境变量与 search.env 不再被直接读取。search_config.sh 重写为
scripts/search-auth.mjs 的薄封装：加锁原子写、权限 600、保留其他
凭据条目，支持 --migrate 从旧 search.env 一次性导入。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

tests/extension-load.test.ts

@@ -201,12 +201,8 @@ test("all package extensions load together without global registration conflicts
 		HOME: home,
 		XDG_CONFIG_HOME: join(home, ".config"),
 		PI_CODING_AGENT_DIR: join(home, ".pi-agent"),
-		MY_PI_SEARCH_CONFIG: join(home, "missing-search.env"),
 		PATH: `${mockBin}:${process.env.PATH ?? ""}`,
 		PI_OFFLINE: "1",
-		TAVILY_API_KEY: "",
-		EXA_API_KEY: "",
-		KEENABLE_API_KEY: "",
 	};
 	const runBundle = () => spawnSync("pi", args, {
 		encoding: "utf8",