fix: bill Step Plan search_web to the plan endpoint

[liuedcson]

Problem

A Step Plan login sent search_web to https://api.stepfun.com/v1/mcp/web_search/mcp
— the open-platform path, which charges a pay-as-you-go API account instead of the
Step Plan credit pool. The credential resolved correctly, so the search succeeded and
the charge silently landed on the wrong account. step_plan_oversea had the same
problem on api.stepfun.ai.

Fix

• Each login profile gets its own endpoint: step_plan / step_plan_oversea use
  /step_plan/v1/mcp/web_search/mcp, platform_cn / platform_oversea keep
  /v1/mcp/web_search/mcp. The table is a Record<StepLoginProfileId, string>, so
  adding a profile is a compile error rather than a silent inheritance of another
  account's billing path.
• An origin-only STEPCODE_SEARCH_WEB_MCP_URL now inherits the profile's path
  instead of a hardcoded /v1 — the same bug by a second route.
• Credentials with no profile (--api-key, STEPCODE_SEARCH_API_KEY, a hand-written
  auth.json) stay on the platform endpoint. A plan credential cannot reach that
  branch: it only comes from /login, which always records a profile, and a
  pre-profile plan login still resolves through the legacy step mapping in
  readStepLoginProfile.
• Search failures now name the endpoint that was used, so a profile/endpoint mismatch
  shows up in the error instead of on a bill.

Verification

With a real mainland Step Plan key, using the free initialize handshake (no search
is billed):

• https://api.stepfun.com/v1/mcp/web_search/mcp → HTTP 402 quota_exceeded
• https://api.stepfun.com/step_plan/v1/mcp/web_search/mcp → HTTP 200
• With profile: "step_plan" in auth.json, the resolver picks the /step_plan/v1
  endpoint and a real search_web call returns results through it.

npm run check passes. packages/coding-agent/test/step-search-web.test.ts covers all
four profiles, the legacy step profile, the profile-less fallback and the origin-only
override.