feat(web-search-deepseek): resolve provider options from the settings section

The provider now takes a thunk rather than a value: it projects the
authoritative section per search, so a stored endpoint, model, or key
reference reaches the next call without re-registering the provider — which
would make the seam's provider selection observable as a flicker.

apiKey already carries role('secret'), so the section is safe to describe:
the literal never rides a response in any layer and a configuration surface
learns only that a key is set.

packages/web/web-search-deepseek/tsconfig.json

@@ -32,6 +32,9 @@
     {
       "path": "../../credentials/credentials"
     },
+    {
+      "path": "../../settings/settings"
+    },
     {
       "path": "../../support/invariants"
     }