feat: add Tavily as a web search provider option

[tavily-integrations]

Summary

Adds Tavily as a fifth configurable search provider in ForgeGod's web search pipeline. This is an additive change — all existing providers (SearXNG, DuckDuckGo, Brave, Exa) remain fully functional and unchanged.

What changed

• forgegod/tools/web.py: Added _search_tavily() async function using tavily-python AsyncTavilyClient, normalising results to the shared {url, title, snippet} schema. Extended web_search() to accept provider='tavily' and tavily_api_key parameter. Added 'tavily' as the last entry in the fallback chain.
• forgegod/config.py: Added tavily_api_key: str = '' field to ReconConfig. Updated search_provider field comment to list tavily as a valid value.
• forgegod/researcher.py: Passes tavily_api_key from ReconConfig through to web_search() in _execute_searches(), matching the existing pattern for brave_api_key and exa_api_key.
• pyproject.toml: Added tavily-python>=0.5 as an optional dependency under a new tavily extra and included it in the all extra.

Dependency changes

• Added tavily-python>=0.5 (optional extra [tavily] and [all])

Environment variable changes

• New: TAVILY_API_KEY — read into ReconConfig.tavily_api_key
• Existing BRAVE_API_KEY and EXA_API_KEY unchanged

Notes for reviewers

• Tavily import is deferred (inside _search_tavily()) so it's only needed when actually used.
• Fallback order is: requested → SearXNG → DuckDuckGo → Brave → Exa → Tavily.
• All existing tests and providers remain untouched.

Automated Review

• Passed after 1 attempt(s)
• Final review: The Tavily migration is clean, minimal, and correct. The implementation follows the exact same patterns as the existing providers (Brave, Exa, DuckDuckGo): API key guard before making calls, lazy import for the optional dependency, matching error handling, and consistent result normalization to {url, title, snippet}. All four files listed in the plan are modified. The optional dependency is registered correctly in both a named [tavily] extra and the [all] catch-all. ReconConfig gains the tavily_api_key field, Researcher._execute_searches() passes it through, and the fallback chain in web_search() includes Tavily last. No regressions, no dead code, no unintended changes.