#18167: feat(web-search): add baseUrl support for Brave Search provider

## Summary Add configurable `baseUrl` for the Brave Search provider, consistent with the existing `baseUrl` support in the Perplexity provider and the `models.providers` pattern. ## Config Options **Provider-specific (preferred):** ```json { "tools": { "web": { "search": { "provider": "brave", "brave": { "baseUrl": "http://localhost:9100/brave", "apiKey": "..." } } } } } ``` **Top-level fallback:** ```json { "tools": { "web": { "search": { "provider": "brave", "baseUrl": "http://localhost:9100/brave", "apiKey": "..." } } } } ``` When `baseUrl` is set, requests go there instead of `https://api.search.brave.com`. When omitted, behavior is unchanged (fully backwards compatible). ## Use Cases - Local caching/rate-limit proxies - Audit logging - Corporate network policies restricting direct outbound connections - Credential-injecting reverse proxies ## Changes - `src/agents/tools/web-search.ts`: Added `BraveConfig` type, `resolveBraveConfig()`, `resolveBraveBaseUrl()`, and updated `resolveSearchApiKey()` to support `brave.apiKey` - `src/agents/tools/web-search-brave-baseurl.test.ts`: 11 unit tests covering baseUrl resolution and config extraction - `src/agents/tools/web-search.e2e.test.ts`: Updated imports for new exports ## Tests All 11 new tests pass. No breaking changes to existing tests. ## Context Discussion: #18125 Related issues: #2317, #13656, #15247 (SearXNG requests that assume `baseUrl` is standard) <!-- greptile_comment --> <h3>Greptile Summary</h3> Adds configurable `baseUrl` support for the Brave Search provider, allowing users to route requests through local proxies, audit loggers, or credential-injecting reverse proxies. The implementation follows the existing Perplexity provider pattern with both provider-specific (`brave.baseUrl`) and top-level fallback (`search.baseUrl`) config options. - Adds `BraveConfig` type, `resolveBraveConfig()`, and `resolveBraveBaseUrl()` functions in `web-search.ts` for config extraction and URL resolution - Updates `resolveSearchApiKey()` to check `brave.apiKey` before falling back to top-level `search.apiKey` and the `BRAVE_API_KEY` env var - Skips API key requirement when a custom `baseUrl` is configured (proxy mode), allowing credential-injecting proxies to work without a local key - Extends the Zod schema, TypeScript types, help text, and labels to support the new `brave` sub-object and top-level `baseUrl` - Adds 11 unit tests and 2 integration tests (doctor config repair, schema validation) covering baseUrl resolution, config extraction, and proxy mode behavior - Fixes `tools.web.search.provider` help text to include "grok" alongside "brave" and "perplexity" <h3>Confidence Score: 4/5</h3> - This PR is safe to merge — it adds a well-tested, backwards-compatible configuration option following established patterns. - The changes are consistent with the existing Perplexity provider baseUrl pattern, properly handle edge cases (empty strings, whitespace, trailing slashes), and include comprehensive tests. The API key bypass for proxy mode is a reasonable design choice with clear documentation. No breaking changes to existing behavior. - No files require special attention. The core logic in `src/agents/tools/web-search.ts` is well-structured and follows existing patterns. _{Last reviewed commit: fd00e9f} <!-- greptile_other_comments_section --> <!-- /greptile_comment -->