#946 web_search duckduckgo provider returns empty results ~2/3 of queries from server IP (no SearXNG/Brave)

Found during #922. After SearXNG removal tools.search.web defaults to duckduckgo. Live smoke from highway-api container 2026-10-16: 'postgresql documentation' -> 3 results; 'python asyncio tutorial' -> 0; 'heathrow airport' -> 0; all with error=None (silent empty success). Vault shared/brave_search not configured (ConfigurationError Secret not found). EARS: When the configured search provider returns zero results due to throttling, the web_search tool shall report a distinguishable error rather than an empty success. The platform shall have a reliable search provider configured (Brave key in Vault shared/brave_search:api_key) before agents depend on web research.