p3: no Tavily daily cap for restricted callers

Restricted searches skip the cap check. Credits land on
tavily:restricted so they never raise the fleet row. Fleet at cap
still falls through.

internal/search/engine_test.go

@@ -195,6 +195,46 @@ func TestDailyCapSkipsTavily(t *testing.T) {
 	}
 }
 
+func TestRestrictedSkipsTavilyCap(t *testing.T) {
+	db, err := dcache.Open(filepath.Join(t.TempDir(), "c.db"), 1<<20, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	tav := fakeSrc{name: NameTavily, hits: []Hit{{URL: "https://t.example/a", Source: NameTavily}}, credits: 1}
+	e := &Engine{Sources: []Source{tav}, DefaultK: 8, Cache: db, TavilyCap: 1, RerankOn: false}
+	e.Run(context.Background(), "q1", 8, false, "titan", dcache.ClassFleet)
+	day := e.now().UTC().Format("2006-01-02")
+	if db.GetSearchCredits(NameTavily, day) != 1 {
+		t.Fatalf("fleet row %d", db.GetSearchCredits(NameTavily, day))
+	}
+	r := e.Run(context.Background(), "q-gs", 8, false, "straylight-gs", dcache.ClassRestricted)
+	if len(r.Hits) != 1 || r.Hits[0].URL != "https://t.example/a" {
+		t.Fatalf("restricted should still get Tavily: %+v %v", r.Hits, r.Warnings)
+	}
+	for _, w := range r.Warnings {
+		if strings.Contains(w, "daily cap") {
+			t.Fatalf("restricted capped: %v", r.Warnings)
+		}
+	}
+	if db.GetSearchCredits(NameTavily, day) != 1 {
+		t.Fatalf("restricted must not raise fleet row, got %d", db.GetSearchCredits(NameTavily, day))
+	}
+	if db.GetSearchCredits(NameTavily+":restricted", day) != 1 {
+		t.Fatalf("restricted row %d", db.GetSearchCredits(NameTavily+":restricted", day))
+	}
+	fleet := e.Run(context.Background(), "q2", 8, false, "titan", dcache.ClassFleet)
+	n := 0
+	for _, w := range fleet.Warnings {
+		if strings.Contains(w, "daily cap") {
+			n++
+		}
+	}
+	if n != 1 {
+		t.Fatalf("fleet still capped: %v", fleet.Warnings)
+	}
+}
+
 func TestDedupeLongerSnippet(t *testing.T) {
 	in := []Hit{
 		{URL: "https://Ex.com/a#x", Snippet: "aa", Source: NameSearxNG},