[codex] Add Bocha web search provider

[wyuc]

Summary

• Add Bocha as a selectable Web Search provider alongside Tavily
• Add Bocha Web Search API adapter, provider dispatch, server env config, and settings defaults
• Pass provider/base URL from the frontend web-search flow and update provider-neutral settings copy
• Add focused tests for Bocha mapping, provider dispatch, and server config resolution

Related Issue

Related to #523

Validation

• pnpm vitest run tests/web-search/bocha.test.ts tests/web-search/index.test.ts tests/server/provider-config.test.ts tests/store/settings-server-sync.test.ts
• pnpm exec tsc --noEmit --pretty false
• pnpm exec eslint app/api/web-search/route.ts app/generation-preview/page.tsx components/settings/web-search-settings.tsx lib/server/classroom-generation.ts lib/server/provider-config.ts lib/store/settings.ts lib/web-search/bocha.ts lib/web-search/constants.ts lib/web-search/format.ts lib/web-search/index.ts lib/web-search/tavily.ts lib/web-search/types.ts tests/server/provider-config.test.ts tests/web-search/bocha.test.ts tests/web-search/index.test.ts

[wyuc]

Code Review Follow-up

Ran a superpowers code-review subagent against PR #524 (origin/main -> codex/bocha-web-search-provider) plus the local logo follow-up.

Findings:

• Critical: client-supplied web-search baseUrl created an SSRF risk.
• Important: server classroom generation did not accept the selected web-search provider/client key.
• Important: settings server sync needed Bocha regression coverage.
• Minor: provider logo assets were untracked before the follow-up commit.
• Minor: Bocha should have a localized Chinese display name.

Follow-up commit 41636b2 addresses:

• Adds route-level client baseUrl allowlisting for Tavily/Bocha; server env baseUrl remains supported for admin-configured proxies.
• Adds selected provider/client-key support for server classroom web search.
• Adds Tavily/Bocha logos and localized provider names (博查 in zh-CN).
• Adds regression tests for base URL validation, classroom web-search config, provider display names, API route behavior, and settings server sync.

Verification:

• pnpm vitest run tests/server/web-search-config.test.ts tests/web-search/constants.test.ts tests/web-search/route.test.ts tests/store/settings-server-sync.test.ts tests/server/provider-config.test.ts tests/web-search/bocha.test.ts tests/web-search/index.test.ts -> 7 files / 83 tests passed.
• pnpm exec eslint app/api/generate-classroom/route.ts app/api/web-search/route.ts components/generation/generation-toolbar.tsx components/settings/index.tsx lib/server/classroom-generation.ts lib/server/web-search-config.ts lib/web-search/constants.ts tests/server/web-search-config.test.ts tests/web-search/constants.test.ts tests/web-search/route.test.ts tests/store/settings-server-sync.test.ts -> passed.
• pnpm exec tsc --noEmit --pretty false -> passed.
• Dev server asset checks: /logos/tavily.svg and /logos/bocha.png both returned 200 OK.

[cosarah]

tested locally, LGTM