chore: update Docker and compose files for PaddleOCR engine (refs #119)

- Replace libtesseract-dev with libgomp1 (OpenMP for PaddlePaddle)
- Pre-download PP-OCRv4 models during Docker build
- Add OCR engine env vars to all compose files (base, staging, prod)
- Add optional Google Vision secret mount (commented, enable on demand)
- Create google-vision-key.json.example placeholder

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

secrets/app/google-vision-key.json.example

@@ -0,0 +1,18 @@
+{
+  "_comment": "Google Vision API service account key for OCR cloud fallback",
+  "_instructions": [
+    "1. Create a Google Cloud service account with Vision API access",
+    "2. Download the JSON key file",
+    "3. Save it as secrets/app/google-vision-key.json (gitignored)",
+    "4. Uncomment the volume mount in docker-compose.yml",
+    "5. Set OCR_FALLBACK_ENGINE=google_vision"
+  ],
+  "type": "service_account",
+  "project_id": "your-project-id",
+  "private_key_id": "",
+  "private_key": "",
+  "client_email": "your-sa@your-project-id.iam.gserviceaccount.com",
+  "client_id": "",
+  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+  "token_uri": "https://oauth2.googleapis.com/token"
+}