websearch: 默认 auto 付费冻结，SearXNG 优先 + 显式解冻开关

- 默认 auto 只走免费链 searxng -> duckduckgo；即使环境里有
  付费 key 也不调用 Perplexity/Exa/Tavily/Brave，SearXNG
  失败也不回落付费，默认使用零付费花费。
- 付费后端代码/测试/文档全部保留；显式 pin（tavily/exa/
  perplexity/brave）仍照常调用，是有意覆盖不是默认。
- 解冻开关 WEBSEARCH_ENABLE_PAID，仅精确值 "1" 才恢复旧链
  （perplexity/exa/tavily/brave/searxng/duckduckgo），默认关；
  开关经 worker search_env 透传进 MCP config env。
- HttpClient 超时/DNS 失败改报显式错误（timeout after Ns /
  URL error），绝不把超时写成“无结果”。
- SearXNG 默认参数核实：代码无 SEARXNG_URL 硬编码默认值；
  SEARXNG_ENGINES 默认 bing,360search 已在基线；WEBSEARCH_TIMEOUT
  默认 20 秒。主机 env 实测仅 SEARXNG_URL=http://searx.diante.me
  一行，故默认 pin 生效；文档 https 漂移改回 http（主机 nginx
  仅听 80、无 443 vhost，https 在 TLS 层即失败）。
- 旧测试更新原因：test_websearch_mcp 原断言默认 auto 为
  perplexity 优先，与新冻结语义直接冲突，故改为断言冻结后
  的 searxng -> duckduckgo 回退 + 不泄漏 key；旧 perplexity ->
  exa 回退断言移至解冻开关测试（WEBSEARCH_ENABLE_PAID=1 下）。
  未删断言、未加 skip、未放宽门禁。
- 文档另删 WEBSEARCH_PROVIDERS 说法：代码从未实现该变量。
- 未推、未建 PR、未合并、未部署、未改主机 env/nginx/filter/
  证书、未做付费后端 live 验证、未创建生产任务。

cloud/websearch_mcp.py

@@ -35,9 +35,19 @@ _TOOLS = [
             "Search the web and return ranked results with title, URL "
             "and snippet, plus a synthesised answer when the provider "
             "supplies one. Use web_fetch to read specific pages. "
-            "provider may be 'auto' (walk Perplexity, Exa, Tavily, "
-            "Brave, then keyless SearXNG / DuckDuckGo, falling back "
-            "on failure) or a single provider name to pin it. "
+            "provider may be 'auto' (frozen default: keyless SearXNG "
+            "first, then DuckDuckGo as the free fallback, falling "
+            "back on failure; the paid backends Perplexity, Exa, "
+            "Tavily and Brave are NOT in the default chain even "
+            "when their keys are set, and a SearXNG failure never "
+            "falls back to a paid backend, so default use never "
+            "incurs paid cost) or a single provider name to pin it "
+            "(pinning a paid backend still calls it: that is an "
+            "explicit override, not a default). Set "
+            "WEBSEARCH_ENABLE_PAID=1 to restore the old default "
+            "chain (Perplexity, Exa, Tavily, Brave, SearXNG, "
+            "DuckDuckGo); unfreezing is explicit and may incur "
+            "paid cost. "
             "scope 'code' restricts results to programming sources "
             "only (official language docs, GitHub, package "
             "registries, Stack Overflow, CVE/NVD); anything else "