feat: add Vision monthly cap, WIF auth, and cloud-primary hybrid engine (refs #127)

- Add VISION_MONTHLY_LIMIT config setting (default 1000)
- Update CloudEngine to use WIF credential config via ADC
- Rewrite HybridEngine to support cloud-primary with Redis counter
- Pass monthly_limit through engine factory

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ocr/app/engines/engine_factory.py

@@ -76,11 +76,18 @@ def create_engine(engine_name: str | None = None) -> OcrEngine:
     from app.engines.hybrid_engine import HybridEngine
 
     threshold = settings.ocr_fallback_threshold
-    hybrid = HybridEngine(primary=primary, fallback=fallback, threshold=threshold)
+    monthly_limit = settings.vision_monthly_limit
+    hybrid = HybridEngine(
+        primary=primary,
+        fallback=fallback,
+        threshold=threshold,
+        monthly_limit=monthly_limit,
+    )
     logger.info(
-        "Created hybrid engine: primary=%s, fallback=%s, threshold=%.2f",
+        "Created hybrid engine: primary=%s, fallback=%s, threshold=%.2f, vision_limit=%d",
         name,
         fallback_name,
         threshold,
+        monthly_limit,
     )
     return hybrid