p3: search API, pinned sources, cache, CLI

POST /v1/search and /v2/search fan in SearXNG, Brave LLM Context, and
Tavily from config-fixed endpoints. Public sources refuse private A
records; SearXNG is a loopback-only client, not the fetch guard.

Cache keys include caller class. Restricted callers search like the
fleet; logs omit query, hosts, URLs, and upstream errors. Degraded
results are not stored. Tavily sends search_depth=basic and drops
answer. Missing keys surface in /healthz.

Default-on sources stay off until the bake-off. Query harvest is not
in this commit.

internal/dcache/dcache_test.go

@@ -4,6 +4,7 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 )
 
 func TestHitMissAndNormalise(t *testing.T) {
@@ -95,6 +96,21 @@ func TestEvictUnderCap(t *testing.T) {
 	}
 }
 
+func TestSearchKeyPartitions(t *testing.T) {
+	now := time.Date(2026, 9, 23, 10, 0, 0, 0, time.UTC)
+	a := SearchKey("Hello", []string{"tavily", "searxng"}, 8, now, ClassFleet)
+	b := SearchKey("hello", []string{"searxng", "tavily"}, 8, now, ClassFleet)
+	if a != b {
+		t.Fatal("norm/sources order")
+	}
+	if SearchKey("hello", []string{"searxng"}, 8, now, ClassRestricted) == a {
+		t.Fatal("class")
+	}
+	if SearchKey("hello", []string{"searxng", "tavily"}, 8, now.Add(time.Hour), ClassFleet) == a {
+		t.Fatal("hour")
+	}
+}
+
 func TestCorruptDBBypass(t *testing.T) {
 	p := filepath.Join(t.TempDir(), "c.db")
 	if err := os.WriteFile(p, []byte("not a database"), 0o600); err != nil {