feat(web-search-deepseek): resolve provider options from the settings section

The provider now takes a thunk rather than a value: it projects the
authoritative section per search, so a stored endpoint, model, or key
reference reaches the next call without re-registering the provider — which
would make the seam's provider selection observable as a flicker.

apiKey already carries role('secret'), so the section is safe to describe:
the literal never rides a response in any layer and a configuration surface
learns only that a key is set.

packages/web/web-search-deepseek/tests/deepseek.e2e.ts

@@ -8,6 +8,12 @@ import {
   DEEPSEEK_DEFAULT_MODEL,
 } from '@deepseek-ai/dsh-web-search-deepseek'
 
+/** Construct the provider over a fixed options value; production passes a live thunk. */
+import type { DeepSeekSearchProviderOptions } from '@deepseek-ai/dsh-web-search-deepseek'
+
+const searchProvider = (options: DeepSeekSearchProviderOptions): DeepSeekSearchProvider =>
+  new DeepSeekSearchProvider(() => options)
+
 /**
  * Disabled real-API probe for the DeepSeek search provider. The live endpoint
  * can complete without structured source blocks, so this is not a reliable
@@ -18,7 +24,7 @@ const maybe = apiKey !== undefined && apiKey.length > 0 ? describe : describe.sk
 
 maybe('DeepSeekSearchProvider real API', () => {
   it.skip('returns citeable sources for a live query via native web_search', async () => {
-    const provider = new DeepSeekSearchProvider({
+    const provider = searchProvider({
       apiKey: apiKey!,
       baseURL: process.env.DEEPSEEK_SEARCH_BASE_URL ?? DEEPSEEK_DEFAULT_BASE_URL,
       model: process.env.DEEPSEEK_SEARCH_MODEL ?? DEEPSEEK_DEFAULT_MODEL,