feat(11-03): wire 18 sources into RegisterAll + credential wiring in cmd/recon.go

- Extend SourcesConfig with GoogleAPIKey, GoogleCX, BingAPIKey, YandexUser, YandexAPIKey, BraveAPIKey
- RegisterAll registers 8 Phase 11 sources alongside 10 Phase 10 sources (18 total)
- cmd/recon.go reads search engine API keys from env vars and viper config
- Guardrail tests updated to assert 18 sources

pkg/recon/sources/register_test.go

@@ -16,9 +16,9 @@ func registerTestRegistry() *providers.Registry {
 	})
 }
 
-// TestRegisterAll_WiresAllTenSources asserts that RegisterAll registers every
-// Phase 10 code-hosting source by its stable name on a fresh engine.
-func TestRegisterAll_WiresAllTenSources(t *testing.T) {
+// TestRegisterAll_WiresAllEighteenSources asserts that RegisterAll registers
+// every Phase 10 + Phase 11 source by its stable name on a fresh engine.
+func TestRegisterAll_WiresAllEighteenSources(t *testing.T) {
 	eng := recon.NewEngine()
 	cfg := SourcesConfig{
 		Registry: registerTestRegistry(),
@@ -28,16 +28,24 @@ func TestRegisterAll_WiresAllTenSources(t *testing.T) {
 
 	got := eng.List()
 	want := []string{
+		"bing",
 		"bitbucket",
+		"brave",
 		"codeberg",
 		"codesandbox",
+		"duckduckgo",
 		"gist",
+		"gistpaste",
 		"github",
 		"gitlab",
+		"google",
 		"huggingface",
 		"kaggle",
+		"pastebin",
+		"pastesites",
 		"replit",
 		"sandboxes",
+		"yandex",
 	}
 	if !reflect.DeepEqual(got, want) {
 		t.Fatalf("RegisterAll names mismatch\n got: %v\nwant: %v", got, want)
@@ -55,8 +63,8 @@ func TestRegisterAll_MissingCredsStillRegistered(t *testing.T) {
 		Limiters: recon.NewLimiterRegistry(),
 	})
 
-	if n := len(eng.List()); n != 10 {
-		t.Fatalf("expected 10 sources registered, got %d: %v", n, eng.List())
+	if n := len(eng.List()); n != 18 {
+		t.Fatalf("expected 18 sources registered, got %d: %v", n, eng.List())
 	}
 
 	// SweepAll with an empty config should filter out cred-gated sources