Merge origin/main into feat/agentic-teams

Conflict in src/mcpd/src/main.ts: both sides touched the import block.
Kept this branch's mapUrlToPermission plus main's bootstrapUngatedGlobal;
dropped main's SET_OWN_PASSWORD_OPERATION import — this branch moved that
usage into middleware/url-permission.ts, which imports it itself.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -880,17 +880,21 @@ Notes:
 
 ### Web search and docs lookup
 
-The `duckduckgo`, `searxng` and `docs-mcp` templates give an agent web search and
-version-pinned library documentation. All are self-hosted and none needs an API key.
-`duckduckgo` needs no backing service at all:
+The `searxng`, `firecrawl`, `duckduckgo` and `docs-mcp` templates give an agent web
+search, page reading and version-pinned library documentation. All can run
+self-hosted without an API key. For agents, pair `searxng` (search) with `firecrawl`
+(page reading); `duckduckgo` needs no backing service but scrapes from your IP and
+gets CAPTCHA-blocked under agent traffic:
 
 ```bash
-mcpctl create server websearch --from-template duckduckgo
+mcpctl create server searxng --from-template searxng --env SEARXNG_URL=http://searxng:8080
+mcpctl create server firecrawl --from-template firecrawl --env FIRECRAWL_API_URL=http://firecrawl-api:3002
 ```
 
 See [docs/web-search.md](docs/web-search.md) for the SearXNG engine setup (including
-the `json` format setting, without which every search silently returns nothing) and
-the `docs-mcp` index-persistence caveat.
+the `json` format setting, without which every search silently returns nothing), why
+none of the search templates probes with a search, and the `docs-mcp`
+index-persistence caveat.
 
 ## Gated Sessions