feat(pi-web-search): 搜索凭据迁移到 Pi auth.json

三个搜索 key 改为 auth.json 中的 tavily/exa/keenable api_key 凭据，
pi-web-search/auth.ts 复刻上游 resolve-config-value 语义（!command、
$VAR 插值、credential env 优先、$$/$! 转义）并在每次调用时读取，
进程环境变量与 search.env 不再被直接读取。search_config.sh 重写为
scripts/search-auth.mjs 的薄封装：加锁原子写、权限 600、保留其他
凭据条目，支持 --migrate 从旧 search.env 一次性导入。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

tests/web-search.test.ts

@@ -8,12 +8,13 @@ const packageJson = JSON.parse(await readFile(new URL("../package.json", import.
 	pi: { extensions: string[]; skills: string[] };
 };
 
-test("pi-web-search is the single search surface, loading after search-config", () => {
+test("pi-web-search is the single search surface and reads credentials from auth.json", () => {
 	const entries = packageJson.pi.extensions;
 	assert.ok(entries.includes("./pi-web-search/index.ts"), "the bundle must load pi-web-search");
-	assert.ok(
-		entries.indexOf("./extensions/search-config.ts") < entries.indexOf("./pi-web-search/index.ts"),
-		"search credentials must load before pi-web-search",
+	assert.equal(
+		entries.includes("./extensions/search-config.ts"),
+		false,
+		"search keys come from auth.json — the env loader extension is retired",
 	);
 	for (const retired of [
 		"./extensions/mcp.ts",