refactor(config): remove web_search from static config

Remove Tools.Web and related WebToolsConfig, DuckDuckGoConfig from config
struct and Default(). Web search providers now resolved dynamically from
config_secrets (tenant-scoped) and builtin_tool_tenant_configs instead of
hardcoded config.json5.

Update config_load_test to match removed config paths. Separate config_secrets
and config_channels loading to clarify schema evolution.

internal/config/config_channels.go

@@ -372,7 +372,6 @@ type ToolsConfig struct {
 	ByProvider       map[string]*ToolPolicySpec  `json:"byProvider,omitempty"` // per-provider overrides
 	ExecApproval     ExecApprovalCfg             `json:"execApproval"`         // exec command approval settings
 	WebFetch         WebFetchPolicyConfig        `json:"web_fetch"`            // domain policy for URL fetching
-	Web              WebToolsConfig              `json:"web"`
 	Browser          BrowserToolConfig           `json:"browser"`
 	RateLimitPerHour int                         `json:"rate_limit_per_hour,omitempty"` // max tool executions per hour per session (0 = disabled)
 	ScrubCredentials *bool                       `json:"scrub_credentials,omitempty"`   // auto-redact API keys/tokens in tool output (default true)
@@ -431,36 +430,6 @@ type ToolPolicySpec struct {
 	ToolCallPrefix string `json:"toolCallPrefix,omitempty"` // prefix to strip from model's tool call names before registry lookup
 }
 
-type WebToolsConfig struct {
-	ProviderOrder []string         `json:"provider_order,omitempty"`
-	Exa           ExaConfig        `json:"exa"`
-	Tavily        TavilyConfig     `json:"tavily"`
-	Brave         BraveConfig      `json:"brave"`
-	DuckDuckGo    DuckDuckGoConfig `json:"duckduckgo"`
-}
-
-type ExaConfig struct {
-	Enabled    bool   `json:"enabled"`
-	APIKey     string `json:"api_key"`
-	MaxResults int    `json:"max_results"`
-}
-
-type TavilyConfig struct {
-	Enabled    bool   `json:"enabled"`
-	APIKey     string `json:"api_key"`
-	MaxResults int    `json:"max_results"`
-}
-
-type BraveConfig struct {
-	Enabled    bool   `json:"enabled"`
-	APIKey     string `json:"api_key"`
-	MaxResults int    `json:"max_results"`
-}
-
-type DuckDuckGoConfig struct {
-	Enabled    bool `json:"enabled"`
-	MaxResults int  `json:"max_results"`
-}
 
 // SessionsConfig controls session behavior.
 // Matching TS src/config/sessions/types.ts + src/config/types.base.ts.

internal/config/config_load.go

@@ -46,9 +46,6 @@ func Default() *Config {
 			RateLimitRPM:    20,
 		},
 		Tools: ToolsConfig{
-			Web: WebToolsConfig{
-				DuckDuckGo: DuckDuckGoConfig{Enabled: true, MaxResults: 5},
-			},
 			Browser: BrowserToolConfig{
 				Enabled:  true,
 				Headless: true,

internal/config/config_load_test.go

@@ -24,9 +24,7 @@ func TestDefault_SensibleDefaults(t *testing.T) {
 	if cfg.Agents.Defaults.MaxToolIterations != DefaultMaxIterations {
 		t.Fatalf("default max iterations: got %d", cfg.Agents.Defaults.MaxToolIterations)
 	}
-	if cfg.Tools.Web.DuckDuckGo.MaxResults != 5 {
-		t.Fatalf("default ddg max results: got %d", cfg.Tools.Web.DuckDuckGo.MaxResults)
-	}
+
 }
 
 // --- Load with missing file → uses defaults ---

internal/config/config_secrets.go

@@ -58,11 +58,6 @@ func (c *Config) MaskedCopy() *Config {
 	maskNonEmpty(&cp.Tts.ElevenLabs.APIKey)
 	maskNonEmpty(&cp.Tts.MiniMax.APIKey)
 
-	// Mask web tool keys
-	maskNonEmpty(&cp.Tools.Web.Exa.APIKey)
-	maskNonEmpty(&cp.Tools.Web.Tavily.APIKey)
-	maskNonEmpty(&cp.Tools.Web.Brave.APIKey)
-
 	// Mask Tailscale auth key
 	maskNonEmpty(&cp.Tailscale.AuthKey)
 
@@ -110,11 +105,6 @@ func (c *Config) StripSecrets() {
 	c.Tts.ElevenLabs.APIKey = ""
 	c.Tts.MiniMax.APIKey = ""
 
-	// Web tool keys
-	c.Tools.Web.Exa.APIKey = ""
-	c.Tools.Web.Tavily.APIKey = ""
-	c.Tools.Web.Brave.APIKey = ""
-
 	// Tailscale auth key
 	c.Tailscale.AuthKey = ""
 }
@@ -167,11 +157,6 @@ func (c *Config) StripMaskedSecrets() {
 	stripIfMasked(&c.Tts.ElevenLabs.APIKey)
 	stripIfMasked(&c.Tts.MiniMax.APIKey)
 
-	// Web tool keys
-	stripIfMasked(&c.Tools.Web.Exa.APIKey)
-	stripIfMasked(&c.Tools.Web.Tavily.APIKey)
-	stripIfMasked(&c.Tools.Web.Brave.APIKey)
-
 	// Tailscale auth key
 	stripIfMasked(&c.Tailscale.AuthKey)
 }
@@ -191,9 +176,6 @@ func (c *Config) ApplyDBSecrets(secrets map[string]string) {
 	apply("tts.elevenlabs.api_key", &c.Tts.ElevenLabs.APIKey)
 	apply("tts.minimax.api_key", &c.Tts.MiniMax.APIKey)
 	apply("tts.minimax.group_id", &c.Tts.MiniMax.GroupID)
-	apply("tools.web.exa.api_key", &c.Tools.Web.Exa.APIKey)
-	apply("tools.web.tavily.api_key", &c.Tools.Web.Tavily.APIKey)
-	apply("tools.web.brave.api_key", &c.Tools.Web.Brave.APIKey)
 	apply("tailscale.auth_key", &c.Tailscale.AuthKey)
 }
 
@@ -213,9 +195,6 @@ func (c *Config) ExtractDBSecrets() map[string]string {
 	collect("tts.elevenlabs.api_key", c.Tts.ElevenLabs.APIKey)
 	collect("tts.minimax.api_key", c.Tts.MiniMax.APIKey)
 	collect("tts.minimax.group_id", c.Tts.MiniMax.GroupID)
-	collect("tools.web.exa.api_key", c.Tools.Web.Exa.APIKey)
-	collect("tools.web.tavily.api_key", c.Tools.Web.Tavily.APIKey)
-	collect("tools.web.brave.api_key", c.Tools.Web.Brave.APIKey)
 	collect("tailscale.auth_key", c.Tailscale.AuthKey)
 
 	return secrets