fix(search): API 后端失败兜底从 DuckDuckGo 换成 Bing

DuckDuckGo 在中国大陆网络下被 DNS 污染 + SNI 重置，完全不可达；
API 后端失败后撞 DDG 兜底等于必然整体失败。Bing 是唯一全球与
中国大陆均免 key 可达的引擎，链尾按可达性选择，不做地理探测。
全链失败错误补充 API 后端配置建议。

Signed-off-by: pinvou3-dev <dev@pinvou3.local>

Author: pinvou3-dev

crates/tui/src/config/search.rs

@@ -8,8 +8,8 @@
 use serde::{Deserialize, Serialize};
 
 /// Search provider enumeration — selects the first backend `web_search` uses.
-/// API-backed providers may visibly degrade through the default DuckDuckGo →
-/// Bing chain after runtime failure or an empty result. Configuration and
+/// API-backed providers may visibly degrade through the keyless Bing tail
+/// after runtime failure or an empty result. Configuration and
 /// network-policy errors fail closed without crossing providers.
 #[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Deserialize, Serialize)]
 #[serde(rename_all = "snake_case")]

crates/tui/src/tools/web/backend.rs

@@ -113,9 +113,14 @@ impl<'a> SearchBackendChain<'a> {
             context, selected,
         )));
         if !matches!(selected, SearchProvider::Bing | SearchProvider::DuckDuckGo) {
+            // The keyless tail must stay reachable from mainland-China
+            // networks, where DuckDuckGo is DNS-poisoned and SNI-reset while
+            // Bing serves both its global and China endpoints without a key.
+            // The tail is picked by reachability, not by geo detection: the
+            // engine never guesses the user's location.
             backends.push(Box::new(ConfiguredSearchBackend::from_provider(
                 context,
-                SearchProvider::DuckDuckGo,
+                SearchProvider::Bing,
             )));
         }
         Self { backends }
@@ -242,7 +247,8 @@ async fn run_backend_chain(
         .collect::<Vec<_>>()
         .join(", ");
     Err(ToolError::not_available(format!(
-        "web search backends unavailable: {backend_ids}"
+        "web search backends unavailable: {backend_ids}; \
+         configure an API-backed [search] provider (tavily, bocha, metaso, baidu, volcengine) for dependable results"
     )))
 }
 
@@ -464,6 +470,47 @@ mod tests {
         }
     }
 
+    /// API-backed providers must fall back to the keyless Bing tail, not
+    /// DuckDuckGo: DDG is unreachable from mainland-China networks
+    /// (DNS poisoning + SNI reset), so a DDG tail turns every API outage
+    /// into a guaranteed total failure there, while Bing stays reachable
+    /// globally without a key. Bing and DuckDuckGo themselves stay
+    /// single-backend chains (their internal fallbacks own that job).
+    #[test]
+    fn forkguard_api_provider_chain_tail_is_bing() {
+        for selected in [
+            SearchProvider::Tavily,
+            SearchProvider::Bocha,
+            SearchProvider::Metaso,
+            SearchProvider::Baidu,
+            SearchProvider::Searxng,
+            SearchProvider::Volcengine,
+            SearchProvider::Sofya,
+        ] {
+            let mut context = ToolContext::new(std::path::PathBuf::from("."));
+            context.search_provider = selected;
+            let chain = SearchBackendChain::from_context(&context);
+            let ids: Vec<BackendId> = chain.backends.iter().map(|backend| backend.id()).collect();
+            let expected_tail = BackendId::Bing;
+            assert_eq!(
+                ids.last(),
+                Some(&expected_tail),
+                "{selected:?} chain must keep a reachable keyless Bing tail"
+            );
+        }
+
+        for selected in [SearchProvider::Bing, SearchProvider::DuckDuckGo] {
+            let mut context = ToolContext::new(std::path::PathBuf::from("."));
+            context.search_provider = selected;
+            let chain = SearchBackendChain::from_context(&context);
+            assert_eq!(
+                chain.backends.len(),
+                1,
+                "{selected:?} must stay a single-backend chain"
+            );
+        }
+    }
+
     #[test]
     fn provider_native_is_fail_closed_without_both_fact_and_client() {
         assert!(!provider_native_is_available(false, false));
@@ -641,6 +688,7 @@ mod tests {
 
         assert!(matches!(error, ToolError::NotAvailable { .. }));
         assert!(message.contains("bocha, duckduckgo"));
+        assert!(message.contains("configure an API-backed [search] provider"));
         assert!(!message.contains(private_error));
         assert!(!message.contains("different private response"));
     }

docs/CONFIGURATION.md

@@ -2274,9 +2274,13 @@ and Tavily, Bocha, Metaso, SearXNG, Baidu, Volcengine, or Sofya can be selected
 when an API-backed provider is preferred.
 
 Configured API providers are attempted first. Runtime failure or an empty
-result visibly degrades through DuckDuckGo and then Bing; the structured search
-receipt records every hop. Missing configuration and network-policy denials
-fail closed without sending the query to another provider.
+result visibly degrades to the keyless Bing tail. Bing is picked over
+DuckDuckGo by reachability, not geo detection: Bing serves both its global and
+China endpoints without a key, while DuckDuckGo is unreachable from
+mainland-China networks. The structured search receipt records every hop.
+Missing configuration and network-policy denials fail closed without sending
+the query to another provider. When every backend is unavailable the tool
+fails closed with an error suggesting API-backed `[search]` providers.
 
 For a private/internal search service that serves DuckDuckGo-compatible HTML,
 keep `provider = "duckduckgo"` and set `base_url`; Codewhale appends the `q`