refactor(gateway): wire web_search with tenant-scoped stores

Move web_search tool registration from gateway_setup (where it received
hardcoded config) into wireExtraTools with access to ConfigSecretsStore
and MessageBus for runtime per-tenant resolution.

Update gateway_setup.go to remove web_search-specific config loading.

cmd/gateway_setup.go

@@ -117,12 +117,7 @@ func setupToolRegistry(
 		toolsReg.Register(browser.NewBrowserTool(browserMgr))
 	}
 
-	// Web tools (web_search + web_fetch)
-	webSearchTool := tools.NewWebSearchTool(tools.WebSearchConfigFromConfig(cfg))
-	if webSearchTool != nil {
-		toolsReg.Register(webSearchTool)
-		slog.Info("web_search tool enabled")
-	}
+	// Web tools (web_fetch; web_search is registered in wireExtraTools after stores are ready)
 	webFetchTool = tools.NewWebFetchTool(tools.WebFetchConfig{
 		Policy:         cfg.Tools.WebFetch.Policy,
 		AllowedDomains: cfg.Tools.WebFetch.AllowedDomains,

cmd/gateway_tools_wiring.go

@@ -24,6 +24,10 @@ func wireExtraTools(
 	globalSkillsDir string,
 	builtinSkillsDir string,
 ) (heartbeatTool *tools.HeartbeatTool, hasMemory bool) {
+	// web_search: tenant-scoped resolve requires stores + msgBus — register here.
+	toolsReg.Register(tools.NewWebSearchTool(pgStores.ConfigSecrets, msgBus))
+	slog.Info("web_search tool registered (tenant-scoped resolve)")
+
 	// DateTime tool (precise time for cron scheduling, memory timestamps, etc.)
 	toolsReg.Register(tools.NewDateTimeTool())