feat(webui): add BYOK web search settings

[Re-bin]

Summary

This PR extends the WebUI BYOK settings experience so users can configure Web Search credentials directly from the settings page, alongside existing LLM provider keys.

What changed

• Added an Apple-style segmented control under BYOK for switching between LLM and Web Search.
• Added a Web Search settings panel for the single persisted tools.web.search configuration.
• Supported provider-specific credential behavior:
  • DuckDuckGo: no credential required
  • SearXNG: requires a base URL
  • Brave, Tavily, Jina, Kagi, Olostep: require an API key
• Kept saved secrets masked in the UI and avoided returning raw API keys from the backend.
• Discarded unsaved credential drafts when switching providers, switching BYOK tabs, or changing expanded LLM provider rows.
• Added Web Search config hot-reload so saved changes apply to new web_search calls without restarting nanobot.
• Localized the new BYOK/Web Search UI copy across supported WebUI locales.

Backend details

• Extended /api/settings with a web_search payload containing:
  • selected provider
  • masked key hint
  • configured base URL
  • supported provider metadata
• Added /api/settings/web-search/update for updating the single Web Search provider config.
• Preserved the existing safe-secret behavior: secrets are written to config, but never echoed back in API responses.
• Added dynamic Web Search config refresh in the registered WebSearchTool, matching the no-restart expectation of the WebUI settings flow.

UX details

• The BYOK page now clearly separates LLM provider keys from Web Search credentials.
• The Web Search panel follows the existing settings card style and keeps the interaction direct.
• Provider switches reset unsaved key/base URL edits, so the UI always returns to the saved value unless the user explicitly clicks Save.
• The settings content no longer shifts horizontally when switching between BYOK tabs.

Test plan

• python -m pytest tests/channels/test_websocket_channel.py::test_settings_api_returns_safe_subset_and_updates_whitelist tests/tools/test_search_tools.py::test_web_search_tool_refreshes_dynamic_config_loader
• python -m ruff check nanobot/agent/loop.py nanobot/agent/tools/web.py nanobot/channels/websocket.py tests/channels/test_websocket_channel.py tests/tools/test_search_tools.py
• npm test -- src/tests/api.test.ts src/tests/app-layout.test.tsx
• npm run build

Notes

npm run lint was not run successfully in this environment because the local eslint binary was unavailable (eslint: not found). Focused TypeScript build, Vitest coverage, backend pytest, and focused Ruff checks passed.