feat(05-02): add SearchProvider backend with model, CRUD, and defaults

- Prisma model SearchProvider with userId/tenantId scoping
- Three default providers (Google/Bing/DuckDuckGo) as constants, always returned without DB seed
- GET/POST/DELETE search-providers endpoints on DashboardController
- Ownership verification on delete (T-05-07), default providers cannot be deleted
- CreateSearchProviderDto with class-validator: urlTemplate must contain {query} (T-05-08)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/dashboard/dashboard.controller.ts

@@ -12,6 +12,7 @@ import {
 } from '@nestjs/common';
 import { Request } from 'express';
 import { DashboardService } from './dashboard.service';
+import { CreateSearchProviderDto } from './dto/create-search-provider.dto';
 import { CreateWidgetDto } from './dto/create-widget.dto';
 import { SaveLayoutDto } from './dto/save-layout.dto';
 import { UpdateWidgetConfigDto } from './dto/update-widget-config.dto';
@@ -30,6 +31,9 @@ import { UpdateWidgetConfigDto } from './dto/update-widget-config.dto';
  * - POST /dashboard/widgets        — create a new widget instance
  * - PATCH /dashboard/widgets/:id/config — update widget config
  * - DELETE /dashboard/widgets/:id  — remove a widget instance
+ * - GET  /dashboard/search-providers     — list default + user's custom providers
+ * - POST /dashboard/search-providers     — create a custom search provider
+ * - DELETE /dashboard/search-providers/:id — remove a custom provider
  */
 @Controller('dashboard')
 export class DashboardController {
@@ -92,4 +96,30 @@ export class DashboardController {
     const { userId } = this.extractContext(req);
     return this.dashboardService.removeWidget(id, userId);
   }
+
+  // --- Search Providers (05-02, D-15) ---
+
+  @Get('search-providers')
+  async getSearchProviders(@Req() req: Request) {
+    const { userId } = this.extractContext(req);
+    return this.dashboardService.getSearchProviders(userId);
+  }
+
+  @Post('search-providers')
+  async addSearchProvider(
+    @Req() req: Request,
+    @Body() dto: CreateSearchProviderDto,
+  ) {
+    const { userId, tenantId } = this.extractContext(req);
+    return this.dashboardService.addSearchProvider(userId, tenantId, dto);
+  }
+
+  @Delete('search-providers/:id')
+  async removeSearchProvider(
+    @Param('id') id: string,
+    @Req() req: Request,
+  ) {
+    const { userId } = this.extractContext(req);
+    return this.dashboardService.removeSearchProvider(id, userId);
+  }
 }