feat: searxng.toml 支持 auth_basic/auth_bearer 认证配置

- common.py: resolve_auth_basic/bearer 新增 config_value 参数，优先级 CLI > file > config > env
- search.py: main() 从 load_config() 读取 auth_basic/auth_bearer；修复 --config 指定文件中 instance 字段不被解析的问题
- LICENSE: 补齐 MIT 协议文件
- tests: +21 测试覆盖配置文件认证优先级链与 main() 集成（309→330）
- docs: SKILL.md/README.md 同步更新认证配置说明与安全提醒

scripts/common.py

@@ -114,7 +114,8 @@ def _warn_file_perms(path: str) -> None:
 
 
 def resolve_auth_basic(cli_value: str = None, file_path: str = None,
-                       env_var: str = "SEARXNG_BASIC_AUTH") -> str:
+                       env_var: str = "SEARXNG_BASIC_AUTH",
+                       config_value: str = None) -> str:
     """Resolve basic-auth credentials without leaking them via shell history.
 
     Priority (highest wins):
@@ -122,7 +123,9 @@ def resolve_auth_basic(cli_value: str = None, file_path: str = None,
                           but leaks into shell history; discouraged)
       2. ``file_path``  — ``--auth-basic-file FILE``; first non-empty line
                           is read as ``user:pass``. Recommended for shells.
-      3. ``env_var``    — ``SEARXNG_BASIC_AUTH`` environment variable.
+      3. ``config_value`` — ``auth_basic`` field from ``searxng.toml``.
+                            Convenient for AI agents that read config once.
+      4. ``env_var``    — ``SEARXNG_BASIC_AUTH`` environment variable.
 
     Returns ``"user:pass"`` or ``None`` if no source provides credentials.
     Raises ``RuntimeError`` if a file is specified but cannot be read.
@@ -143,16 +146,26 @@ def resolve_auth_basic(cli_value: str = None, file_path: str = None,
         except OSError as e:
             raise RuntimeError(f"cannot read auth file '{file_path}': {e}") from e
 
+    if config_value:
+        return config_value
+
     import os
     return os.environ.get(env_var)
 
 
 def resolve_auth_bearer(cli_value: str = None, file_path: str = None,
-                        env_var: str = "SEARXNG_BEARER_TOKEN") -> str:
-    """Resolve a Bearer token from CLI flag, file, or environment variable.
+                        env_var: str = "SEARXNG_BEARER_TOKEN",
+                        config_value: str = None) -> str:
+    """Resolve a Bearer token from CLI flag, file, config, or environment.
 
     Mirrors :func:`resolve_auth_basic` for token-style auth. Useful for
     long-lived API tokens that should not appear in shell history.
+
+    Priority (highest wins):
+      1. ``cli_value``  — explicit ``--auth-bearer "token"``
+      2. ``file_path``  — ``--auth-bearer-file FILE``
+      3. ``config_value`` — ``auth_bearer`` field from ``searxng.toml``
+      4. ``env_var``    — ``SEARXNG_BEARER_TOKEN`` environment variable
     """
     if cli_value:
         return cli_value
@@ -170,6 +183,9 @@ def resolve_auth_bearer(cli_value: str = None, file_path: str = None,
         except OSError as e:
             raise RuntimeError(f"cannot read token file '{file_path}': {e}") from e
 
+    if config_value:
+        return config_value
+
     import os
     return os.environ.get(env_var)