feat: 重构 WebSearch/WebFetch，新增 Tavily 适配器及 /web-tools 面板

- WebSearch: 默认 Tavily，适配器优先级 WEB_SEARCH_ADAPTER > settings.webSearchAdapter > tavily
- WebFetch: 支持 Tavily /extract 返回 Markdown，移除 domain blacklist 远程检查
- 新增 /web-tools 命令面板（Search/Fetch 双 Tab + 二级配置菜单）
- 新增 settings 字段: webSearchAdapter, webFetchAdapter, tavilyEndpointUrl, braveApiKey, exaApiKey, exaEndpointUrl, webFetchHttpTimeoutMs
- 适配器联动: Tavily/Exa 从 settings 读取 endpoint 和 API key

Co-Authored-By: deepseek-v4-pro <deepseek-ai@claude-code-best.win>

packages/builtin-tools/src/tools/WebSearchTool/adapters/exaAdapter.ts

@@ -10,9 +10,10 @@
 
 import axios from 'axios'
 import { AbortError } from 'src/utils/errors.js'
+import { getSettings_DEPRECATED } from 'src/utils/settings/settings.js'
 import type { SearchResult, SearchOptions, WebSearchAdapter } from './types.js'
 
-const EXA_MCP_URL = 'https://mcp.exa.ai/mcp'
+const DEFAULT_EXA_MCP_URL = 'https://mcp.exa.ai/mcp'
 const FETCH_TIMEOUT_MS = 25_000
 
 export class ExaSearchAdapter implements WebSearchAdapter {
@@ -38,10 +39,24 @@ export class ExaSearchAdapter implements WebSearchAdapter {
     const searchType = options.searchType ?? 'auto'
     const contextMaxCharacters = options.contextMaxCharacters ?? 10000
 
+    // Read settings for custom endpoint / API key
+    const settings = getSettings_DEPRECATED() as Record<string, unknown> & {
+      exaEndpointUrl?: string
+      exaApiKey?: string
+    }
+    const exaUrl = settings.exaEndpointUrl || DEFAULT_EXA_MCP_URL
+    const headers: Record<string, string> = {
+      'Content-Type': 'application/json',
+      Accept: 'application/json, text/event-stream',
+    }
+    if (settings.exaApiKey) {
+      headers['Authorization'] = `Bearer ${settings.exaApiKey}`
+    }
+
     let responseText: string
     try {
       const response = await axios.post(
-        EXA_MCP_URL,
+        exaUrl,
         {
           jsonrpc: '2.0',
           id: 1,
@@ -60,10 +75,7 @@ export class ExaSearchAdapter implements WebSearchAdapter {
         {
           signal: abortController.signal,
           timeout: FETCH_TIMEOUT_MS,
-          headers: {
-            'Content-Type': 'application/json',
-            Accept: 'application/json, text/event-stream',
-          },
+          headers,
           responseType: 'text',
         },
       )