Cloudflare Web Search dialect + live-matrix model refresh

[CMGS]

Summary

• search: add a cloudflare dialect to SearchEngine next to brave. A provider: cloudflare account posts {query, limit, options.gateway.id} to {endpoint}/ai/websearch/ with the API token as Bearer, where endpoint is https://api.cloudflare.com/client/v4/accounts/<account_id> and the gateway is the account's default. count is capped at the vendor limit of 10, and the vendor body (items + metadata) passes through. One unit per query, the same as Brave. The Brave dialect is unchanged; it is only paused in the live matrix because there is no live key.
• live-matrix: replace models that vendors retired or that this account can no longer reach:
  • qwen3-max → qwen3.8-max, qwen3-235b-a22b → qwen3.7-plus (Anthropic-compatible, thinking), qwen-turbo → qwen-flash (DashScope native wire), ernie-x1.1 → ernie-5.1 (reasoning).
  • Drop gemini-2.5-flash, which is closed to new users.
  • Drop the sora-2 video case: OpenAI removed the Videos API on 2026-09-24, and /v1/videos now answers 404.

Hot-path cost

Zero for non-search traffic. The new arm sits inside SearchEngine::run, which is reached only for Protocol::Search. A Cloudflare search pays one small JSON body and one URL format!, the same as the generic arm.

Verification

• cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo test --workspace: 739 passed, 0 failed, 4 ignored (env-gated suites).
• New tests: cloudflare_search_request_shape covers the URL, body, limit cap and Bearer header. search_routes_each_dialect_and_bills_one_unit runs the end-to-end route and ledger for both Brave and Cloudflare.
• Live run against a locally built gw (release, this branch):
  • search: cf-web-search against the real Cloudflare API returned 3 results, and the ledger recorded 1 unit / 250 micros.
  • qwen, qianfan, siliconflow, minimax and dashscope-native: all pass with the new model names, including ernie-5.1 reasoning in both buffered and stream mode.
  • video: 4/4, covering Wan2.2 on SiliconFlow, wan2.2-t2v-plus, Hailuo-02 and Kling.
  • Kling also passes at 16:9, 9:16 and 1:1, in pro mode, and at 10 s.
  • ollama: 3/3.
• Not covered live: Brave (no key) and Bedrock (no working key).