p3: search API, pinned sources, cache, CLI

POST /v1/search and /v2/search fan in SearXNG, Brave LLM Context, and
Tavily from config-fixed endpoints. Public sources refuse private A
records; SearXNG is a loopback-only client, not the fetch guard.

Cache keys include caller class. Restricted callers search like the
fleet; logs omit query, hosts, URLs, and upstream errors. Degraded
results are not stored. Tavily sends search_depth=basic and drops
answer. Missing keys surface in /healthz.

Default-on sources stay off until the bake-off. Query harvest is not
in this commit.

dist/sift.toml.example

@@ -37,3 +37,23 @@ listen = "127.0.0.1:8890"
 # honcho = "http://rift.scylla-hammerhead.ts.net:8000"
 # workspaces = ["hermes-fleet"]
 # permit_restricted = []  # caller names allowed to query guardian-star
+#
+# [search]
+# k = 8
+# timeout = "8s"
+# rerank = true
+# digest = false
+# cache_ttl = "1h"
+#
+# [search.searxng]
+# enabled = false
+# url = "http://127.0.0.1:8888"
+#
+# [search.brave_llm]
+# enabled = false
+# url = "https://api.search.brave.com/res/v1/llm/context"
+#
+# [search.tavily]
+# enabled = false
+# url = "https://api.tavily.com/search"
+# daily_credit_cap = 500