websearch: 默认 auto 付费冻结，SearXNG 优先 + 显式解冻开关

- 默认 auto 只走免费链 searxng -> duckduckgo；即使环境里有
  付费 key 也不调用 Perplexity/Exa/Tavily/Brave，SearXNG
  失败也不回落付费，默认使用零付费花费。
- 付费后端代码/测试/文档全部保留；显式 pin（tavily/exa/
  perplexity/brave）仍照常调用，是有意覆盖不是默认。
- 解冻开关 WEBSEARCH_ENABLE_PAID，仅精确值 "1" 才恢复旧链
  （perplexity/exa/tavily/brave/searxng/duckduckgo），默认关；
  开关经 worker search_env 透传进 MCP config env。
- HttpClient 超时/DNS 失败改报显式错误（timeout after Ns /
  URL error），绝不把超时写成“无结果”。
- SearXNG 默认参数核实：代码无 SEARXNG_URL 硬编码默认值；
  SEARXNG_ENGINES 默认 bing,360search 已在基线；WEBSEARCH_TIMEOUT
  默认 20 秒。主机 env 实测仅 SEARXNG_URL=http://searx.diante.me
  一行，故默认 pin 生效；文档 https 漂移改回 http（主机 nginx
  仅听 80、无 443 vhost，https 在 TLS 层即失败）。
- 旧测试更新原因：test_websearch_mcp 原断言默认 auto 为
  perplexity 优先，与新冻结语义直接冲突，故改为断言冻结后
  的 searxng -> duckduckgo 回退 + 不泄漏 key；旧 perplexity ->
  exa 回退断言移至解冻开关测试（WEBSEARCH_ENABLE_PAID=1 下）。
  未删断言、未加 skip、未放宽门禁。
- 文档另删 WEBSEARCH_PROVIDERS 说法：代码从未实现该变量。
- 未推、未建 PR、未合并、未部署、未改主机 env/nginx/filter/
  证书、未做付费后端 live 验证、未创建生产任务。

cloud/tests/test_websearch_mcp.py

@@ -67,18 +67,38 @@ def _exa_body():
 
 
 class ChainTestCase(unittest.TestCase):
-    def test_fallback_perplexity_to_exa_and_key_not_leaked(self):
+    def test_default_auto_frozen_falls_back_searxng_to_duckduckgo_and_key_not_leaked(self):
+        # Paid-freeze update of the old perplexity -> exa fallback
+        # test: default auto no longer contains any paid backend,
+        # even when all four paid keys are set, so the fallback
+        # that still exists by default is searxng -> duckduckgo
+        # and no paid URL is ever touched. The old perplexity ->
+        # exa fallback is preserved, but only under
+        # WEBSEARCH_ENABLE_PAID=1; see test_websearch_paid_freeze.py.
+        html = (
+            '<a class="result__a" href="//duckduckgo.com/l/?uddg='
+            'https%3A%2F%2Fexample.com%2Fddg">DDG Title</a>'
+            '<a class="result__snippet">ddg snippet</a>')
         http = FakeHttp([
-            ("perplexity", {}, 500),
-            ("api.exa.ai", _exa_body(), 200),
+            ("searx", {}, 500),
+            ("duckduckgo", html, 200),
         ])
+        env = dict(_FAKE_KEYS)
+        env["SEARXNG_URL"] = "http://searx.test"
         out = search("test query", provider="auto",
-                     env=dict(_FAKE_KEYS), http=http)
-        self.assertEqual(out["provider"], "exa")
+                     env=env, http=http)
+        self.assertEqual(out["provider"], "duckduckgo")
         self.assertEqual(out["results"][0]["url"],
-                         "https://example.com/exa")
-        self.assertEqual(out["attempted"][0]["provider"], "perplexity")
+                         "https://example.com/ddg")
+        self.assertEqual(out["attempted"][0]["provider"], "searxng")
         self.assertFalse(out["attempted"][0]["ok"])
+        self.assertEqual(
+            [a["provider"] for a in out["attempted"]],
+            ["searxng", "duckduckgo"])
+        for _method, url, _payload in http.seen:
+            for paid in ("perplexity", "exa.ai", "tavily",
+                         "search.brave.com"):
+                self.assertNotIn(paid, url)
         blob = json.dumps(out)
         for secret in _FAKE_KEYS.values():
             self.assertNotIn(secret, blob)