#549 feat(search): always include Alexandria in authenticated firecrawl_search

Authenticated firecrawl_search now always asks for Alexandria provider matches, including when the caller passes sources that leave it out.

Behaviour

Request	Sent sources (authenticated)	Keyless / no credential
sources omitted or []	["web", "alexandria"] (unchanged)	["web"] (unchanged)
["web"]	["web", "alexandria"]	["web"]
["news"], ["web", "images"]	requested sources + "alexandria"	requested sources
[{ type: "web" }]	[{ type: "web" }, { type: "alexandria" }] (form preserved, since the API rejects mixed arrays)	requested sources
["alexandria"] alone	unchanged	key-required error (unchanged)

• alexandria is never duplicated; exchange still normalizes to alexandria.
• enterprise: ["zdr"] or ["anon"] does not get Alexandria added, because the API refuses provider discovery for those modes.
• domainTools keeps defaulting to true when Alexandria is combined with web, news or images; an explicit domainTools: false is respected.
• When the API refuses discovery the caller did not ask for (for example a team with forced zero data retention), the search retries once on the caller's requested sources instead of always ["web"]. postSearchWithFallback takes the fallback sources as an optional fourth argument, so existing callers keep working.
• The same logic applies to the search-surface copy in src/service/search-surface.ts.

Billing is unchanged: the API counts only web, news, image and index results toward search credits, and provider discovery is free. A live check returned the same creditsUsed for ["web"] with and without Alexandria.

Copy

Search descriptions, the sources parameter and the server instructions replace the sources: ["web"] opt-out sentence with the always-on behaviour. The scrape description no longer says "with sources unset". The description stays within the 2,048-character cap.

Tests

• New cases cover web, news, mixed, object-form, explicit Alexandria, gov and developer categories, ZDR and anon, a credential-less session, and the fallback to requested sources.
• Contract snapshots regenerated; version bumped to 3.30.3 with a changelog entry.

---

Summary by cubic

Authenticated firecrawl_search now always asks for Alexandria provider matches, even when the caller passes sources that leave it out.

• sources arrays without Alexandria get it appended, preserving string or object form; omitted or empty sources still default to ["web", "alexandria"].
• ["alexandria"] alone, keyless or credential-less sessions, and enterprise: ["zdr"] or ["anon"] searches are unchanged.
• When the API refuses the added discovery, the search retries on the caller's requested sources instead of always ["web"]; postSearchWithFallback takes the fallback sources as an optional fourth argument.
• Tool and server copy now describes the always-on behavior, including that zdr and anon searches do not add it.
• Billing is unchanged; provider discovery is free and creditsUsed matches a ["web"]-only request.