[verified] add Nous Portal web research adapter

docs/DEPLOYMENT.md

@@ -17,22 +17,32 @@ After the first successful login, remove both values from `.env`, restart the AP
 
 Copy `.env.example` to an untracked deployment environment file. Production requires a secret-manager supplied `SESSION_SECRET` of at least 32 characters and refuses `AUTOMATED_OUTREACH_ENABLED=true`. Keep bootstrap credentials one-time only; remove and rotate them after provisioning. Never place secrets in images, Compose YAML, logs, backups, or public web roots.
 
-For optional native OpenAI Responses web-search discovery, set these exact server-side variables (and do not use a custom gateway):
+For optional native Nous Portal Chat Completions tool-calling discovery, set these
+server-side variables:
 
 ```dotenv
-AI_RESEARCH_PROVIDER=openai_web_search
-AI_RESEARCH_PROVIDER_MODEL=<OpenAI model supporting web search>
-AI_RESEARCH_PROVIDER_URL=https://api.openai.com/v1/responses
-AI_RESEARCH_PROVIDER_ALLOWED_HOSTS=api.openai.com
-OPENAI_API_KEY=<standard OpenAI API key>
+AI_RESEARCH_PROVIDER=nous_portal
+NOUS_API_KEY=<Nous Portal API key>
+NOUS_MODEL=Hermes-4-405B
+NOUS_BASE_URL=https://inference-api.nousresearch.com/v1
+NOUS_ALLOWED_HOSTS=inference-api.nousresearch.com
+FIRECRAWL_API_KEY=<Firecrawl API key>
+FIRECRAWL_BASE_URL=https://api.firecrawl.dev/v1
+FIRECRAWL_ALLOWED_HOSTS=api.firecrawl.dev
 ```
 
-`OPENAI_API_KEY` is never returned in provider status or logs. The adapter uses
-OpenAI's official `web_search` tool, limits the response to 64 KiB and candidates
-to 50, accepts only HTTPS URLs from bounded citations/sources, and passes every
-candidate through the server's SSRF-safe fetcher. Criteria containing common
-prompt-injection instructions are rejected. Anthropic/Google, if approved,
-continue using the generic adapter and `AI_RESEARCH_PROVIDER_API_KEY`.
+The adapter calls Nous at `/chat/completions` with strict `web_search` and
+`scrape_website` function tools. Tool calls are executed only against the
+allowlisted Firecrawl-compatible API, capped at 4 calls and 16 KiB per tool
+result. Prompt-injection-shaped criteria are rejected and tool/page content is
+untrusted data. The final model response is parsed only as structured JSON
+HTTPS targets; the existing crawler performs SSRF validation and persists
+fetched-page evidence. Missing either key, unavailable providers, unsafe base
+URLs, malformed tool calls, oversized responses, and exhausted budgets fail
+closed. Status metadata never includes secrets.
+
+The prior OpenAI Responses and generic provider variables remain supported only
+as compatibility adapters.
 
 Validate before startup: