#781 Wire up web-search provider: self-hosted SearXNG backend for web_search (was keyless DDG, blocked on datacenter IP)

web_search used keyless DuckDuckGo HTML which throttles datacenter IPs -> empty results -> thin leaf findings. FIXED: made docker/highway-core/engine/tools/web_search.py provider-configurable ([search] provider=searxng|brave|duckduckgo, searxng_url) with a DDG fallback and a Brave API option (Vault shared/brave_search:api_key). Stood up a keyless self-hosted SearXNG service in docker-compose (docker/searxng/settings.yml: use_default_settings, json format on, limiter off, generated secret) on highway_network at http://searxng:8080. Set config [search] provider=searxng. Verified: SearXNG JSON API returns 27 results; web_search tool returns real sourced results; leaves now research with real URLs. Engine image rebuilt + workers restarted. Brave key can be dropped in later for higher reliability.