Add native OpenAI web search research adapter

docs/DEPLOYMENT.md

@@ -17,6 +17,23 @@ After the first successful login, remove both values from `.env`, restart the AP
 
 Copy `.env.example` to an untracked deployment environment file. Production requires a secret-manager supplied `SESSION_SECRET` of at least 32 characters and refuses `AUTOMATED_OUTREACH_ENABLED=true`. Keep bootstrap credentials one-time only; remove and rotate them after provisioning. Never place secrets in images, Compose YAML, logs, backups, or public web roots.
 
+For optional native OpenAI Responses web-search discovery, set these exact server-side variables (and do not use a custom gateway):
+
+```dotenv
+AI_RESEARCH_PROVIDER=openai_web_search
+AI_RESEARCH_PROVIDER_MODEL=<OpenAI model supporting web search>
+AI_RESEARCH_PROVIDER_URL=https://api.openai.com/v1/responses
+AI_RESEARCH_PROVIDER_ALLOWED_HOSTS=api.openai.com
+OPENAI_API_KEY=<standard OpenAI API key>
+```
+
+`OPENAI_API_KEY` is never returned in provider status or logs. The adapter uses
+OpenAI's official `web_search` tool, limits the response to 64 KiB and candidates
+to 50, accepts only HTTPS URLs from bounded citations/sources, and passes every
+candidate through the server's SSRF-safe fetcher. Criteria containing common
+prompt-injection instructions are rejected. Anthropic/Google, if approved,
+continue using the generic adapter and `AI_RESEARCH_PROVIDER_API_KEY`.
+
 Validate before startup:
 
 ```sh