feat: add brave search container and toolset

config/default.yaml

@@ -245,6 +245,21 @@ models:
 # - `tools.profile: coding` or `tools.profile: full` must allow browser.* tools.
 # - `tools.deny` patterns can still block browser.* even when browser.enabled is true.
 
+# ── Web Search ───────────────────────────────────────────────────────
+# Configure web.search tools.
+# - provider: brave   -> enables web.search + web.search.news (requires api_key)
+# - provider: searxng -> enables web.search (requires endpoint)
+#
+# web_search:
+#   provider: brave
+#   api_key: "${BRAVE_API_KEY}"
+#   max_results: 5
+#   # endpoint: "http://searxng:8080"     # Used when provider=searxng
+#
+# Optional local Brave Search MCP container (for MCP workflows only):
+#   docker compose --profile search up -d brave-search
+# Built-in web.search* tools call Brave/SearXNG HTTP endpoints directly.
+
 hooks:
   confirm:
     - shell.*