feat: Add Tavily as a selectable web_search provider

Problem statement / motivation

Part of #291
Status: Ready for implementation (builds on typed provider contract established in #293 and #294)
Scope: Tavily provider integration, configuration plumbing, and tests

Tavily is a premier search engine purpose-built for AI agents and LLM applications (used by LangChain, AutoGen, and CrewAI):

• Agent-optimized content: Cleans webpage content, filters out SEO spam/clickbait, and provides high-density, factual snippets directly optimized for LLM context windows.
• Native domain filtering: Native server-side support for include_domains and exclude_domains.
• News and raw content support: Direct support for news topic filtering and answer synthesis.
• Differences from You.com / Brave: Tavily uses POST /search with a JSON payload (rather than GET with query parameters), authenticates via api_key in body or Authorization: Bearer header, and structures results with max_results (up to 20).

Proposed solution

A. Provider Implementation (tool/web_search/tavily.rs)

• Endpoint: POST {base_url}/search with Content-Type: application/json.
• Authentication: Authorization: Bearer {api_key} header (or api_key in payload). Key resolved from TAVILY_API_KEY.
• Deserialization: Forward-compatible structs with #[serde(default)] mapping Tavily's response envelope (results: [{ title, url, content, published_date }]) to WebSearchProviderResponse.
• Request body payload:

{
  "query": "...",
  "search_depth": "basic",
  "max_results": 10,
  "topic": "general",
  "include_domains": [],
  "exclude_domains": []
}

B. Input Adaptation Policy Matrix

C. Concurrency & Rate Limiting

• Concurrency Ceiling: Configurable via AGENTIC_WEB_SEARCH_MAX_CONCURRENT_QUERIES, defaulting to gateway limit or tier allowance.
• 429 Handling: Fail web_search_call without retry, surfacing Retry-After verbatim per RFC 7231.
• Auth Errors (401/403): Report failure explicitly naming TAVILY_API_KEY without leaking credentials or echoing response body.

D. Configuration & Precedence Matrix

Scope Boundaries

Verification Checklist

• 200 OK (Search & News): Verify JSON POST payload shapes correctly and responses map to WebSearchResult.
• Domain Filtering: Verify native include_domains/exclude_domains JSON fields are populated.
• 401 / 403 Authentication: Fails web_search_call, references TAVILY_API_KEY, does not leak credentials.
• 429 Rate Limit: Surfaces Retry-After verbatim without retrying.
• Metadata: Echoes "provider": "tavily" in metadata[].
• Zero Regressions: You.com and Brave Search remain byte-identical and unaffected.
• Hygiene: cargo fmt, cargo clippy --all-targets -- -D warnings, and file size limits pass.

Start with the typed provider contract established in issues #293 and #294, then inspect tool/web_search/tavily.rs and the existing provider implementations. Run or extend tests/web_search_tavily_test.rs using Axum mock HTTP tests. Done means the documented request mappings, authentication and error handling, metadata, domain filtering, and regression checks pass with cargo fmt and clippy.