feat: add TavilyProvider to search fallback chain (priority 3)

[tavily-integrations]

Summary

Adds Tavily as a configurable search provider in the multi-provider fallback chain, slotted at priority 3 between SearXNG (1) and SerpAPI (5). This is an additive change — all existing providers remain untouched.

Tavily is an LLM-optimized search API that provides high-quality, relevant results. It is disabled by default and activates only when TAVILY_API_KEY is set, consistent with the BraveSearchProvider and SerpAPIProvider patterns.

Files changed

• server/src/search/TavilyProvider.ts (new) — Implements SearchProvider interface using @tavily/core SDK. Maps Tavily response fields (title, url, content) to the SearchResult shape.
• server/src/search/SearchProviderManager.ts — Imports and registers TavilyProvider at priority 3. Updated fallback chain comment to include Tavily.
• server/src/search/index.ts — Exports TavilyProvider.
• server/package.json — Added @tavily/core dependency.
• .env.example — Added TAVILY_API_KEY env var reference.

Dependency changes

• Added @tavily/core: ^0.6.4 to server/package.json

Environment variable changes

• Added TAVILY_API_KEY to .env.example (optional, enables TavilyProvider when set)

Updated fallback chain

1. SearXNG (priority 1) — self-hosted
2. Tavily (priority 3) — NEW
3. SerpAPI (priority 5)
4. Brave Search (priority 10)
5. DuckDuckGo (priority 50) — free fallback

Notes for reviewers

• No existing providers were modified
• Pre-existing type errors in DuckDuckGoProvider.ts and tough-cookie are unrelated to this change
• The provider uses searchDepth: 'basic' by default for cost efficiency (1 credit per search)

Automated Review

• Passed after 1 attempt(s)
• Final review: The Tavily migration is correctly implemented. TavilyProvider.ts properly implements the SearchProvider interface, uses the @tavily/core SDK correctly, is registered at priority 3 in the fallback chain, exported from search/index.ts, and documented in .env.example. The server/package.json adds only @tavily/core. The package-lock.json changes beyond @tavily/core's transitive deps (pdf-parse reconciliation, @napi-rs/canvas removal) are legitimate side effects of npm install updating a previously-stale lock file. Three minor issues were found, none blocking.