p3: search API, pinned sources, cache, CLI

POST /v1/search and /v2/search fan in SearXNG, Brave LLM Context, and
Tavily from config-fixed endpoints. Public sources refuse private A
records; SearXNG is a loopback-only client, not the fetch guard.

Cache keys include caller class. Restricted callers search like the
fleet; logs omit query, hosts, URLs, and upstream errors. Degraded
results are not stored. Tavily sends search_depth=basic and drops
answer. Missing keys surface in /healthz.

Default-on sources stay off until the bake-off. Query harvest is not
in this commit.

nix/module.nix

@@ -113,9 +113,13 @@ in
         fi
         if [ ! -f /var/lib/sift/secret.env ]; then
           umask 027
-          printf '%s\n' '# BRAVE_API_KEY=  (set on-box; do not read SearXNG secret.env)' > /var/lib/sift/secret.env
+          printf '%s\n' '# BRAVE_API_KEY=  (set on-box; do not read SearXNG secret.env)' '# TAVILY_API_KEY=  (set on-box; never commit)' > /var/lib/sift/secret.env
           chown root:sift /var/lib/sift/secret.env
           chmod 0640 /var/lib/sift/secret.env
+        else
+          if ! grep -q '^#* *TAVILY_API_KEY' /var/lib/sift/secret.env; then
+            printf '%s\n' '# TAVILY_API_KEY=  (set on-box; never commit)' >> /var/lib/sift/secret.env
+          fi
         fi
       '';
     };
@@ -165,6 +169,7 @@ in
         ReadWritePaths = [ "/var/lib/sift" ];
         ConfigurationDirectory = "sift";
         StateDirectory = "sift";
+        EnvironmentFile = "-/var/lib/sift/secret.env";
       };
     };