feat(11-03): wire 18 sources into RegisterAll + credential wiring in cmd/recon.go

- Extend SourcesConfig with GoogleAPIKey, GoogleCX, BingAPIKey, YandexUser, YandexAPIKey, BraveAPIKey
- RegisterAll registers 8 Phase 11 sources alongside 10 Phase 10 sources (18 total)
- cmd/recon.go reads search engine API keys from env vars and viper config
- Guardrail tests updated to assert 18 sources

pkg/recon/sources/register.go

@@ -28,20 +28,32 @@ type SourcesConfig struct {
 	KaggleUser string
 	KaggleKey  string
 
+	// Google Custom Search API key and search engine ID (CX).
+	GoogleAPIKey string
+	GoogleCX     string
+	// Bing Web Search API subscription key.
+	BingAPIKey string
+	// Yandex XML Search user and API key.
+	YandexUser   string
+	YandexAPIKey string
+	// Brave Search API subscription token.
+	BraveAPIKey string
+
 	// Registry drives query generation for every source via BuildQueries.
 	Registry *providers.Registry
 	// Limiters is the shared per-source rate-limiter registry.
 	Limiters *recon.LimiterRegistry
 }
 
-// RegisterAll registers every Phase 10 code-hosting source on engine.
+// RegisterAll registers every Phase 10 code-hosting and Phase 11 search
+// engine / paste site source on engine (18 sources total).
 //
-// All ten sources are registered unconditionally so that cmd/recon.go can
-// surface the full catalog via `keyhunter recon list` regardless of which
-// credentials are configured. Sources without required credentials return
-// Enabled()==false so SweepAll skips them without erroring.
+// All sources are registered unconditionally so that cmd/recon.go can surface
+// the full catalog via `keyhunter recon list` regardless of which credentials
+// are configured. Sources without required credentials return Enabled()==false
+// so SweepAll skips them without erroring.
 //
-// A nil engine is treated as a no-op (not an error) — callers in broken init
+// A nil engine is treated as a no-op (not an error) -- callers in broken init
 // paths shouldn't panic.
 func RegisterAll(engine *recon.Engine, cfg SourcesConfig) {
 	if engine == nil {
@@ -95,4 +107,46 @@ func RegisterAll(engine *recon.Engine, cfg SourcesConfig) {
 		Registry: reg,
 		Limiters: lim,
 	})
+
+	// Phase 11: Search engine dorking sources.
+	engine.Register(&GoogleDorkSource{
+		APIKey:   cfg.GoogleAPIKey,
+		CX:       cfg.GoogleCX,
+		Registry: reg,
+		Limiters: lim,
+	})
+	engine.Register(&BingDorkSource{
+		APIKey:   cfg.BingAPIKey,
+		Registry: reg,
+		Limiters: lim,
+	})
+	engine.Register(&DuckDuckGoSource{
+		Registry: reg,
+		Limiters: lim,
+	})
+	engine.Register(&YandexSource{
+		User:     cfg.YandexUser,
+		APIKey:   cfg.YandexAPIKey,
+		Registry: reg,
+		Limiters: lim,
+	})
+	engine.Register(&BraveSource{
+		APIKey:   cfg.BraveAPIKey,
+		Registry: reg,
+		Limiters: lim,
+	})
+
+	// Phase 11: Paste site sources.
+	engine.Register(&PastebinSource{
+		Registry: reg,
+		Limiters: lim,
+	})
+	engine.Register(&GistPasteSource{
+		Registry: reg,
+		Limiters: lim,
+	})
+	engine.Register(&PasteSitesSource{
+		Registry: reg,
+		Limiters: lim,
+	})
 }