p3: search API, pinned sources, cache, CLI

POST /v1/search and /v2/search fan in SearXNG, Brave LLM Context, and
Tavily from config-fixed endpoints. Public sources refuse private A
records; SearXNG is a loopback-only client, not the fetch guard.

Cache keys include caller class. Restricted callers search like the
fleet; logs omit query, hosts, URLs, and upstream errors. Degraded
results are not stored. Tavily sends search_depth=basic and drops
answer. Missing keys surface in /healthz.

Default-on sources stay off until the bake-off. Query harvest is not
in this commit.

internal/search/canonical_test.go

@@ -0,0 +1,23 @@
+package search
+
+import "testing"
+
+func TestCanonicalURL(t *testing.T) {
+	cases := []struct {
+		in, want string
+	}{
+		{"https://Example.COM/a/b#frag", "https://example.com/a/b"},
+		{"http://example.com:80/x", "http://example.com/x"},
+		{"https://example.com:443/x", "https://example.com/x"},
+		{"https://example.com/x/", "https://example.com/x"},
+		{"https://www.example.com/x", "https://www.example.com/x"},
+		{"https://example.com/", "https://example.com"},
+		{"HTTP://Ex.com:80/a/?q=1", "http://ex.com/a?q=1"},
+	}
+	for _, c := range cases {
+		got := CanonicalURL(c.in)
+		if got != c.want {
+			t.Errorf("CanonicalURL(%q)=%q want %q", c.in, got, c.want)
+		}
+	}
+}