feat: add optional you.com search provider for web_search

[mouse-value-add]

What this adds

An optional You.com engine for the built-in web_search tool. src/utils/web.ts already has a SearchProvider fallback chain (duckduckgo-lite → sogou), so this adds a third provider that reuses the same loop, retry helper, and SearchResult shape:

• youcom is only tried first when YDC_API_KEY is set in the environment
• whitespace-only keys are treated as unset
• if the request fails, returns non-200, or the JSON payload has no usable hits, the chain continues to DuckDuckGo Lite and Sogou exactly as before

So with no key configured, nothing changes for existing users.

Setup

export YDC_API_KEY=***   # from https://you.com/platform/api-keys

That's it — no config file changes, no new dependencies (plain fetch with an X-API-Key header against https://api.ydc-index.io/search), keeping with the lightweight principle in CONTRIBUTING.md.

What changed

• src/utils/web.ts: new youcom member of SearchProvider, getSearchProviders() builds the chain (youcom first only when the key is set), a JSON fetch branch, and parseYoucomResults() mapping hits[] to the existing SearchResult type
• USAGE.md: short "Web search backends" subsection under Configuration documenting the chain and the opt-in
• test/web-search-provider.test.ts: new suite (node:test, same style as the rest of test/) covering:
  • default chain is unchanged without the key
  • youcom is first when the key is set
  • whitespace-only key is ignored
  • a malformed youcom response falls back to DuckDuckGo (fetch stubbed)

Validation

• npm run check (tsc --noEmit) — clean
• npm run lint — clean
• npm test — 278 passing, 0 failing (274 baseline + 4 new)
• Live API check (with a real key): YDC_API_KEY=*** npx tsx -e "import('./src/utils/web.js').then(m => m.searchDuckDuckGoLite({ query: 'mcp spec' })).then(r => console.log(r.base_resp.source, r.organic.length))" — expected youcom 5

Happy to adjust the shape if you'd rather have the provider list configurable via settings.json instead of env-only, or drop the docs change.