feat: add Tavily as a web search engine option

[tavily-integrations]

Summary

Adds Tavily as a fifth selectable web search engine in the web_search tool, alongside the existing DuckDuckGo, Bing, Google, and Baidu engines. This is an additive change — all existing engines remain unchanged.

Tavily Search API is called via raw HTTP POST (same pattern as Google/Baidu), so no new Go module dependencies are needed. The API key is stored in the tool's clientSecret database field, consistent with existing engines.

Changes

Backend (tool/web_search.go)

• Added webSearchEngineTavily constant and tavilySearchEndpoint URL
• Added tavilySearchRequest and tavilySearchResponse structs
• Added runTavilySearch and parseTavilySearchResponse functions
• Extended parseWebSearchEngine switch to handle "Tavily" subtype
• Extended runWebSearch switch to dispatch to Tavily engine

Frontend

• web/src/Setting.js: Added {id: 'Tavily', name: 'Tavily'} to web_search subtype options
• web/src/ToolEditPage.js: Extended shouldShowClientSecretInput to show API key field when subType is "Tavily"
• web/src/locales/en/data.json: Added "Tavily API Key" and tooltip string
• web/src/locales/zh/data.json: Added Chinese translations for Tavily tooltip

Seed Data (object/init.go)

• Added an inactive web_search_tavily tool record so admins see Tavily in the tool list and only need to supply their API key to activate it

Dependency changes

• None (uses existing net/http client pattern)

Environment variable changes

• The Tavily API key is stored in the tool's clientSecret DB field (not a process env var), obtained from https://app.tavily.com

Notes for reviewers

• The Tavily API accepts POST to https://api.tavily.com/search with {api_key, query, max_results} in the JSON body
• Response maps cleanly to the existing webSearchResult struct
• Go compiler was not available in the build environment; syntax was verified manually

Automated Review

• Passed after 1 attempt(s)
• Final review: The Tavily migration is well-implemented and consistent with the existing provider pattern. All six listed files are correctly modified. The backend adds the engine constant, endpoint, request/response structs, runTavilySearch, and extends both switch statements following the same structure as the Baidu provider. The frontend adds the subtype dropdown entry, clientSecret visibility, and locale strings. The seed record in init.go is correctly inactive. One minor issue: two i18n locale keys ("Tavily API Key" and "Tavily API Key - Tooltip") are added but never referenced in any JS component — getClientSecretLabel uses the generic "provider:API key" label for all web_search types, making the new strings dead code.