add Firecrawl discovery backend and settings

tests/test_app.py

@@ -191,6 +191,32 @@ class BrowserOnlyAppTests(unittest.TestCase):
         saved = server.db().execute("SELECT ai_probability,ai_recommendation,ai_reasoning FROM prospects WHERE id=1").fetchone()
         self.assertEqual(tuple(saved), (84.0, "contact", "Active business with a clear website opportunity."))
 
+    def test_firecrawl_search_normalises_public_results(self):
+        response = {"success": True, "data": {"web": [{"title": "Cape Town Plumbing", "url": "https://plumber.example.co.za/", "description": "Local plumbing services"}]}}
+        with patch("api.server.http_json", return_value=response) as request, patch("api.server._safe_url", return_value=True):
+            results = server.firecrawl_search("plumbers Cape Town", 5, api_key="fc-test")
+        self.assertEqual(results[0]["website"], "https://plumber.example.co.za")
+        self.assertEqual(results[0]["source"], "firecrawl")
+        self.assertEqual(results[0]["description"], "Local plumbing services")
+        self.assertEqual(request.call_args.args[0], "POST")
+        self.assertIn("/v2/search", request.call_args.args[1])
+        self.assertEqual(request.call_args.kwargs["headers"]["Authorization"], "Bearer fc-test")
+
+    def test_firecrawl_backend_requires_key_and_is_exposed_without_secret(self):
+        with patch.dict(os.environ, {"DISCOVERY_BACKEND": "firecrawl", "FIRECRAWL_API_KEY": ""}, clear=False):
+            with self.assertRaisesRegex(RuntimeError, "firecrawl_api_key_required"):
+                server.firecrawl_search("plumbers Cape Town", 5)
+
+    def test_firecrawl_settings_persist_without_returning_secret(self):
+        status, result = self.request("POST", "/api/settings", {"discovery": {"backend": "firecrawl", "firecrawl_api_key": "fc-secret-test"}})
+        self.assertEqual(status, 200)
+        self.assertTrue(result["discovery"]["firecrawl_configured"])
+        self.assertNotIn("fc-secret-test", json.dumps(result))
+        status, settings = self.request("GET", "/api/settings")
+        self.assertEqual(status, 200)
+        self.assertEqual(settings["discovery"]["backend"], "firecrawl")
+        self.assertNotIn("fc-secret-test", json.dumps(settings))
+
     def test_live_site_snapshot_captures_design_signals_for_generation(self):
         class Response:
             headers = {"Content-Type": "text/html; charset=utf-8"}
@@ -213,6 +239,7 @@ class BrowserOnlyAppTests(unittest.TestCase):
         self.assertIn("layout-editorial", first)
         self.assertIn("layout-bento", second)
 
+    def test_mockup_fallback_is_saved_and_public_share_link_works(self):
         conn = server.db()
         conn.execute("INSERT INTO prospects(name,domain,category,address,phone,emails,website,website_status,discovered_at) VALUES(?,?,?,?,?,?,?,?,?)", ("Acme Plumbing", "maps:acme", "plumbers", "Cape Town", "+27101234567", "info@acme.co.za", "", "no_detected_website", server.now()))
         conn.commit(); conn.close()