fix: review — Brave API key + webFetchHttpTimeoutMs 联动 + Tavily URL 推导

- braveAdapter: 读取 settings.braveApiKey (优先于环境变量)
- webFetch utils: getFetchTimeoutMs() 统一读取 settings.webFetchHttpTimeoutMs，HTTP/Tavily 两条路径均生效
- tavilyAdapter: 自定义端点自动追加 /search 路径（与 fetchContentWithTavily 一致）

Co-Authored-By: deepseek-v4-pro <deepseek-ai@claude-code-best.win>

packages/builtin-tools/src/tools/WebSearchTool/adapters/braveAdapter.ts

@@ -5,6 +5,7 @@
 
 import axios from 'axios'
 import { AbortError } from 'src/utils/errors.js'
+import { getSettings_DEPRECATED } from 'src/utils/settings/settings.js'
 import type { SearchResult, SearchOptions, WebSearchAdapter } from './types.js'
 
 const FETCH_TIMEOUT_MS = 30_000
@@ -156,6 +157,14 @@ function normalizeSnippet(snippets: string[] | undefined): string | undefined {
 }
 
 function getBraveApiKey(): string {
+  // Priority: settings.braveApiKey (from /web-tools panel) > environment variable
+  const settings = getSettings_DEPRECATED() as Record<string, unknown> & {
+    braveApiKey?: string
+  }
+  if (settings.braveApiKey?.trim()) {
+    return settings.braveApiKey.trim()
+  }
+
   for (const envVar of BRAVE_API_KEY_ENV_VARS) {
     const value = process.env[envVar]?.trim()
     if (value) {

packages/builtin-tools/src/tools/WebSearchTool/adapters/tavilyAdapter.ts

@@ -43,7 +43,11 @@ export class TavilySearchAdapter implements WebSearchAdapter {
     const settings = getSettings_DEPRECATED() as Record<string, unknown> & {
       tavilyEndpointUrl?: string
     }
-    const searchUrl = settings.tavilyEndpointUrl || DEFAULT_TAVILY_SEARCH_URL
+    const baseUrl = settings.tavilyEndpointUrl || DEFAULT_TAVILY_SEARCH_URL
+    // Ensure the URL ends with /search (same pattern as fetchContentWithTavily for /extract)
+    const searchUrl = baseUrl.endsWith('/search')
+      ? baseUrl
+      : `${baseUrl.replace(/\/$/, '')}/search`
 
     try {
       const response = await axios.post<{