[Egorich-print]

Problem

Out of the box (zero search provider credentials configured), POST /v1/search always failed with:

OmniRoute API error [400]: {"error":{"message":"No credentials configured for any search provider. Add an API key for a search provider (serper-search, brave-search, ...) in the dashboard.","type":"invalid_request_error","code":"bad_request"}}

even though the registry ships a free no-key provider (duckduckgo-free) exactly for this case.

Root cause

In the auto-select path of src/app/api/v1/search/route.ts, fallback-only providers (duckduckgo-free, searxng-search) were only ever promoted to the alternate slot (the last-resort failover block). When no credentialed provider was found, the 400 error was returned before that block could run — so the last-resort path was dead code in the zero-credentials case.

The lib variant src/lib/search/executeWebSearch.ts already handles this correctly (it promotes duckduckgo-free with empty credentials), so the two paths disagreed.

Fix

Promote a fallback-only provider to the primary pick as a last resort before failing, mirroring executeWebSearch():

• duckduckgo-free runs with empty credentials (HTML scraping path, no key needed)
• searxng-search is used only when it has explicitly configured credentials
• honors blockedProviders and rate-limit state like the rest of the selection logic