fix: sanitize subprocess env for DDGS worker

os.environ.copy() passes all Hermes secrets (gateway tokens, API keys,
dashboard session tokens) into the DDGS child process. Use
_sanitize_subprocess_env() to strip Hermes-managed secrets before
spawning the worker.

plugins/web/ddgs/provider.py

@@ -156,7 +156,9 @@ def _run_ddgs_search_bounded(query: str, safe_limit: int) -> list[dict[str, Any]
     if _test_hook:
         request["test_hook"] = _test_hook
 
-    env = os.environ.copy()
+    from tools.environments.local import _sanitize_subprocess_env
+
+    env = _sanitize_subprocess_env(dict(os.environ))
     if _test_hook:
         env["HERMES_DDGS_ALLOW_TEST_HOOKS"] = "1"