feat: add Vision monthly cap, WIF auth, and cloud-primary hybrid engine (refs #127)

- Add VISION_MONTHLY_LIMIT config setting (default 1000)
- Update CloudEngine to use WIF credential config via ADC
- Rewrite HybridEngine to support cloud-primary with Redis counter
- Pass monthly_limit through engine factory

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ocr/app/config.py

@@ -21,7 +21,12 @@ class Settings:
             os.getenv("OCR_FALLBACK_THRESHOLD", "0.6")
         )
         self.google_vision_key_path: str = os.getenv(
-            "GOOGLE_VISION_KEY_PATH", "/run/secrets/google-vision-key.json"
+            "GOOGLE_VISION_KEY_PATH", "/run/secrets/google-wif-config.json"
+        )
+
+        # Google Vision monthly usage cap (requests per calendar month)
+        self.vision_monthly_limit: int = int(
+            os.getenv("VISION_MONTHLY_LIMIT", "1000")
         )
 
         # Redis configuration for job queue