feat: searxng.toml 支持 auth_basic/auth_bearer 认证配置

- common.py: resolve_auth_basic/bearer 新增 config_value 参数，优先级 CLI > file > config > env
- search.py: main() 从 load_config() 读取 auth_basic/auth_bearer；修复 --config 指定文件中 instance 字段不被解析的问题
- LICENSE: 补齐 MIT 协议文件
- tests: +21 测试覆盖配置文件认证优先级链与 main() 集成（309→330）
- docs: SKILL.md/README.md 同步更新认证配置说明与安全提醒

scripts/search.py

@@ -1429,17 +1429,32 @@ Use --config FILE to load a non-default config file (overrides the auto-discover
 
     # Resolve instance(s): -i > SEARXNG_INSTANCE env > config file
     instance_urls = resolve_instances(args.instance)
+    # Fallback: if --config was used, instance may be in the config dict
+    # but not in the default search paths that resolve_instances checks.
+    if not instance_urls and config.get("instance"):
+        instance_urls = parse_instances(config["instance"])
+    elif not instance_urls and config.get("instances"):
+        raw = config["instances"]
+        if isinstance(raw, str):
+            instance_urls = parse_instances(raw)
+        elif isinstance(raw, list):
+            instance_urls = [u if u.startswith(("http://", "https://"))
+                             else "https://" + u for u in raw if u and str(u).strip()]
     if not instance_urls:
         _emit_error("no SearXNG instance resolved. Provide -i/--instance, set the "
                     "SEARXNG_INSTANCE environment variable, or create a searxng.toml / "
                     "instances.txt config file.", args, error_code=E_CONFIG)
 
     # Build auth headers if provided (needed by both verify and search).
-    # Credentials may come from CLI flag, file, or env var (in priority order)
-    # to avoid leaking secrets via shell history or `ps`.
+    # Credentials may come from CLI flag, file, config file, or env var
+    # (in priority order) to avoid leaking secrets via shell history or `ps`.
     try:
-        bearer_token = resolve_auth_bearer(args.auth_bearer, args.auth_bearer_file)
-        basic_auth = resolve_auth_basic(args.auth_basic, args.auth_basic_file)
+        bearer_token = resolve_auth_bearer(
+            args.auth_bearer, args.auth_bearer_file,
+            config_value=config.get("auth_bearer"))
+        basic_auth = resolve_auth_basic(
+            args.auth_basic, args.auth_basic_file,
+            config_value=config.get("auth_basic"))
     except RuntimeError as e:
         _emit_error(str(e), args, error_code=E_AUTH)
     auth_headers = build_auth_headers(