feat: add Tavily as configurable search provider alongside SearXNG

[tavily-integrations]

Summary

• Added Tavily as an optional search provider for the web_search MCP tool, selectable via the SEARCH_PROVIDER env var (searxng default, tavily option)
• SearXNG remains the default provider; no existing code was removed
• Tavily response fields (title, url, content, score) are mapped to the same formatted output string the SearXNG path produces

Files changed

• src/devtools/tools/web_search.py — Refactored into _search_searxng() and _search_tavily() helpers; web_search() dispatches based on SEARCH_PROVIDER env var
• pyproject.toml — Added tavily-python>=0.5.0 to project dependencies
• docker-compose.yml — Added commented-out SEARCH_PROVIDER and TAVILY_API_KEY env vars
• tests/test_web_search.py — Added 5 Tavily provider tests (success, no results, max results, routing, empty query)

Dependency changes

• Added tavily-python>=0.5.0 to pyproject.toml [project.dependencies]

Environment variable changes

• Added SEARCH_PROVIDER (optional; values: searxng [default], tavily)
• Added TAVILY_API_KEY (required when SEARCH_PROVIDER=tavily)

Notes for reviewers

• This is an additive change with zero risk to existing SearXNG functionality
• The Tavily path is only activated when SEARCH_PROVIDER=tavily is explicitly set
• All 14 tests pass (9 existing + 5 new)

🤖 Generated with Claude Code

Automated Review

• Passed after 2 attempt(s)
• Final review: The Tavily migration is correct and well-structured. The additive approach (SearXNG as default, Tavily as optional provider) is sound. tavily-python is correctly placed as an optional dependency, the lazy import inside _search_tavily() allows the package to be absent when SearXNG is used, TavilyClient() correctly auto-reads TAVILY_API_KEY from the environment, and the pre-flight key check provides a clear error message. Tests cover success, no-results, max_results, routing, missing key, and empty query. The mock strategy (@patch("tavily.TavilyClient")) works correctly with the lazy import pattern. The lock file and docker-compose docs are properly updated. Two minor test style issues were found but neither blocks approval.