feat(plugins): implement web-search, web-fetch, http and file tools

- web-search: real SearXNG /search?format=json query, top-5 formatted
  results (was a 'not configured' stub)
- web-fetch: fetch page, strip scripts/styles/tags, truncate to 4000
  runes for the LLM context
- http: generic request tool (GET/POST/PUT/DELETE/PATCH) with scheme
  and method validation, status + truncated body
- file: sandboxed read/write/list inside the data directory with path
  escape rejection; split into file_read/file_write/file_list
- all tool schemas converted to proper JSON Schema; httptest/tempdir
  tests for each plugin

backend/plugins/web-fetch/plugin_test.go

@@ -0,0 +1,49 @@
+package webfetch
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestFetchStripsHTML(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(`<html><head><style>body{color:red}</style><script>var x=1</script></head>
+			<body><h1>标题</h1><p>正文内容</p></body></html>`))
+	}))
+	defer srv.Close()
+
+	p := New()
+	out, err := p.Execute(context.Background(), "web_fetch", map[string]any{"url": srv.URL})
+	if err != nil {
+		t.Fatalf("Execute: %v", err)
+	}
+	if !strings.Contains(out, "标题") || !strings.Contains(out, "正文内容") {
+		t.Errorf("missing text: %q", out)
+	}
+	if strings.Contains(out, "color:red") || strings.Contains(out, "var x=1") || strings.Contains(out, "<p>") {
+		t.Errorf("HTML/script/style leaked: %q", out)
+	}
+}
+
+func TestFetchRejectsBadURL(t *testing.T) {
+	p := New()
+	for _, u := range []string{"", "ftp://x", "example.com"} {
+		if _, err := p.Execute(context.Background(), "web_fetch", map[string]any{"url": u}); err == nil {
+			t.Errorf("url %q should be rejected", u)
+		}
+	}
+}
+
+func TestFetchHTTPError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(404)
+	}))
+	defer srv.Close()
+	p := New()
+	if _, err := p.Execute(context.Background(), "web_fetch", map[string]any{"url": srv.URL}); err == nil {
+		t.Error("expected error for 404")
+	}
+}