feat(search): support an explicit custom API endpoint

[roberts-pumpurs]

Play search cannot reach an owned local registry because it always calls the hosted search Worker.

Before

play-search rejects a local registry URL. Agents cannot discover real fixtures in an ephemeral Supabase stack.

After

Run the same command with PLAY_SEARCH_ENDPOINT set to an explicit API endpoint. Play sends the request there and checks the response against the configured registry URL, including after token refresh.

HTTPS endpoints and literal HTTP loopback endpoints are allowed. Redirects are refused. Local registries use test Play URLs throughout selection, inspection, execution, and publication. Local website cards remain unsupported rather than reading production.

The default production and staging endpoints stay unchanged.

Validation

Installed this checkout through rote install play in a private home. Published two real weather versions to an owned Supabase stack, inspected and ran version 0.0.1, and searched through the installed native command. Native Play accepted the local API response and preserved version 0.0.2. Missing model credentials remained an explicit incomplete result.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}