feat: websearch MCP worker wiring + egress (public SearXNG route)

Worker --websearch-mcp (default off) seeds tenant codex-home with
websearch MCP on _tenant_dirs (container path); old tenants merge
on next task. Autoscaler unit gains the flag. Tinyproxy filter
adds Perplexity/Exa/Tavily/Brave/DuckDuckGo + exact
searx.diante.me (no diante.me wildcard, control plane stays out).
Tests: test_websearch_worker 4 + websearch_mcp 12 + tenant 7 = 23 OK.
Not pushed, not merged, not deployed; SearXNG host/DNS/nginx and
tinyproxy reload are host steps.

deploy/egress/tinyproxy-filter

@@ -21,3 +21,13 @@
 ^\(.*\.\)*pypi\.org$
 ^\(.*\.\)*pythonhosted\.org$
 ^\(.*\.\)*npmjs\.org$
+# Web search MCP v1 (see docs/web-search-mcp.md). Each line is the
+# API host's domain, subdomains included, in the same BASIC form.
+# searx.diante.me is exact-only on purpose: a \(.*\.\)*diante.me$
+# line would also let tasks reach api.diante.me (the control plane).
+^\(.*\.\)*perplexity\.ai$
+^\(.*\.\)*exa\.ai$
+^\(.*\.\)*tavily\.com$
+^\(.*\.\)*search\.brave\.com$
+^\(.*\.\)*duckduckgo\.com$
+^searx\.diante\.me$