Make /api/search honest: explain empty results + clear config errors

[stretchcloud]

The real problem

/api/search returned {success:true, count:0, results:[]} for every query — with no indication of why. You couldn't tell "no hits" from "provider blocked" from "provider not configured". That silent empty is what wasted debugging time.

Root cause of the empty results in production: the default keyless provider (DuckDuckGo's HTML endpoint) anti-bot-challenges datacenter / server IPs — HTTP 202. I confirmed this from two independent datacenter IPs (the VPS and this sandbox), on both html. and lite. endpoints. It's a DuckDuckGo policy, not a parser bug — the parser is fine, DDG just refuses to serve hosted IPs. So it genuinely cannot be "fixed" into working keyless from a server.

What this PR does — make it transparent, not pretend

• search.service: new runSearch() returns { results, provider, reason? }. Each provider fetcher now reports an actionable reason (DDG 202 challenge, request failure…). searchWeb() is kept as a results-only wrapper, so existing callers/tests are untouched. New emptyResultHint(provider) gives the provider-specific explanation and the real fix.
• Route: the response now includes provider and, when empty, a note explaining why — e.g. "DuckDuckGo returned an anti-bot challenge (HTTP 202)… set SERPER_API_KEY (free at serper.dev) or SEARXNG_URL." Missing provider config now returns a 400 with the actionable message instead of an opaque 500.

Reliable search still needs config, but it's free and already supported: SERPER_API_KEY (Serper.dev free tier, auto-selected when present) or a self-hosted SEARXNG_URL.

Verification (Docker, end-to-end)

Case	Result
default provider, no config	200 · provider:duckduckgo · count:0 · note explaining the 202 block + fix
provider:searxng, no SEARXNG_URL	400 with the actionable message (was an opaque 500)
SEARXNG_URL configured (mock)	200 · provider:searxng · count:2 real results flow through

tsc ✅ · eslint ✅ · 204 tests ✅ (+3 new) · openapi:check ✅

Note: keyless DuckDuckGo is left as the best-effort default (it works from residential IPs), but the response now makes its server-side limitation explicit rather than silent.

🤖 Generated with Claude Code