feat: add Tavily as configurable search provider alongside DuckDuckGo

[tavily-integrations]

Summary

Adds Tavily as an optional web search provider in PenNoteAI, keeping DuckDuckGo as the default. Users can switch providers via a dropdown in plugin settings and provide their Tavily API key.

• Created src/search/tavily.ts — TavilySearcher class calling Tavily Search REST API via Obsidian's requestUrl, with result caching matching DuckDuckGo's pattern
• Extended PenNoteSettings in src/types.ts with searchProvider ('duckduckgo' | 'tavily') and tavilyApiKey fields
• Added Search Provider dropdown and conditional Tavily API Key input in src/settings.ts under Search & Crawl section
• Updated ToolRunner in src/agent/tool-runner.ts to accept DuckDuckGoSearcher | TavilySearcher
• Updated src/main.ts with a createSearcher() factory method; searcher is re-created on settings change

Files changed

• src/search/tavily.ts (new)
• src/types.ts
• src/settings.ts
• src/agent/tool-runner.ts
• src/main.ts

Dependency changes

• None — Tavily API is called directly via Obsidian's requestUrl (no npm package needed)

Environment / config changes

• tavilyApiKey: stored in plugin settings (not a process env var), entered via settings UI
• searchProvider: new setting field, defaults to "duckduckgo"

Notes for reviewers

• DuckDuckGo integration is fully preserved and remains the default
• No breaking changes to existing settings — new fields have safe defaults
• Tavily API key is rendered as a password field in settings, only shown when Tavily is selected

Automated Review

• Passed after 1 attempt(s)
• Final review: The Tavily migration is well-implemented and additive. TavilySearcher correctly mirrors the DuckDuckGoSearcher shape (same SearchResult interface, same caching pattern, same requestUrl usage, same clearCache method). Types, defaults, settings UI, factory method, and settings-change re-initialization are all correct. No existing functionality is broken. Two minor issues: an unused updateApiKey() method that is dead code, and Tavily API authentication places the key in the request body (api_key field) rather than the Authorization: Bearer header — the body approach still works per Tavily's REST API, but the header approach is the current recommended style.