🚀 Context

Currently, the web_search tool relies exclusively on the Brave Search API. While Brave offers a generous free tier (2,000 queries/month), signing up often requires a credit card for verification. This creates significant friction for new users or those running on ephemeral hardware (like the $10 SBCs PicoClaw targets) who just want to test the agent out of the box.

✨ Changes

This PR introduces a Smart Search Provider system that automatically degrades gracefully if no API key is configured.

• Refactor: Abstracted search logic in pkg/tools/web.go into a SearchProvider interface.
• New Provider: Implemented DuckDuckGoSearchProvider which scrapes generic HTML results.
  • Engineering Note: Uses lightweight Regex parsing instead of DOM libraries (like goquery) to maintain the strictly mandated <10MB RAM footprint.
• Auto-Fallback: If config.tools.web.search.api_key is empty, the system automatically switches to DuckDuckGo.

📝 Example Scenarios

Scenario 1: No Configuration (New User)

Previously, this would return an error or panic.

Config:

// ~/.picoclaw/config.json
{
  "tools": {
    "web": { "search": {} } // No API Key set
  }
}

Terminal Output:

$ picoclaw agent -m "Who won the super bowl 2026?"

[LOG] Search API key missing. Falling back to DuckDuckGo (Free/No-Auth).
[AGENT] Searching web for: "Super Bowl 2026 winner"
[AGENT] The Seattle Seahawks won the 2026 Super Bowl, defeating the New England Patriots with a score of 29-13. This victory marked the Seahawks' second title in franchise history.

Scenario 2: Power User (Brave API)

Users who want higher rate limits and structured JSON results can still use Brave.

Config:

{
  "tools": {
    "web": {
      "search": { "api_key": "BSAxx..." }
    }
  }
}

Behavior:
The system detects the key and initializes the BraveSearchProvider automatically. No code changes required by the user.

✅ Checklist

• Refactored web.go to use Provider pattern
• Implemented Regex-based HTML parser for DDG (Memory safe)
• Updated README.md to explain the free fallback tier
• Verified build size remains constant (no heavy scraping dependencies added)