v1.11.8: web_search + web_fetch tools via SearXNG

Adds two new tools registered through the existing ALL_TOOLS registry:
  - web_search hits SearXNG's JSON API (Fathom, internal Tailscale URL,
    no auth) and returns top results
  - web_fetch retrieves a URL's text content, gated by isPublicUrl
    (url_guard.ts) which blocks loopback / RFC1918 / Tailscale CGNAT /
    link-local / .local / .internal / non-http schemes

Both tools are opt-in via the existing session.web_search_enabled flag
(plumbed in v1.9, activated here). Default off. UI labels updated to
"Enable web search and fetch" / "Web search and fetch" since fetch joins
the same store. Counts against the v1.8.2 per-turn budget; covered by
the v1.11.6 doom-loop guard.

Native Node 20 fetch — no new prod dep. HTML stripping via regex (script
and style content elided wholesale). 5MB body cap, 15s fetch timeout,
8000-char default output, 32000-char cap.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/src/components/panes/SettingsPane.tsx

@@ -245,7 +245,7 @@ function SessionSection({ session, project }: { session: Session; project: Proje
       <div className="space-y-1.5">
         <div className="flex items-center justify-between gap-3">
           <label htmlFor="session-web-search" className="text-xs font-medium uppercase tracking-wide text-muted-foreground">
-            Web search
+            Web search and fetch
           </label>
           <Switch
             id="session-web-search"