feat: update all Docker Compose files for Vision primary with WIF auth (refs #127)

- Switch OCR engine config to google_vision primary / paddleocr fallback
- Mount Auth0 OCR secrets and WIF config into all OCR containers
- Add WIF config to repo (not a secret, contains no credentials)
- Remove obsolete google-vision-key.json.example

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.staging.yml

@@ -69,10 +69,17 @@ services:
       REDIS_HOST: mvp-redis
       REDIS_PORT: 6379
       REDIS_DB: 1
-      OCR_PRIMARY_ENGINE: paddleocr
-      OCR_FALLBACK_ENGINE: ${OCR_FALLBACK_ENGINE:-none}
-      OCR_FALLBACK_THRESHOLD: ${OCR_FALLBACK_THRESHOLD:-0.6}
-      GOOGLE_VISION_KEY_PATH: /run/secrets/google-vision-key.json
+      # OCR engine configuration (Google Vision primary, PaddleOCR fallback)
+      OCR_PRIMARY_ENGINE: google_vision
+      OCR_FALLBACK_ENGINE: paddleocr
+      OCR_CONFIDENCE_THRESHOLD: "0.6"
+      OCR_FALLBACK_THRESHOLD: "0.6"
+      GOOGLE_VISION_KEY_PATH: /run/secrets/google-wif-config.json
+      VISION_MONTHLY_LIMIT: "1000"
+    volumes:
+      - ./secrets/app/auth0-ocr-client-id.txt:/run/secrets/auth0-ocr-client-id:ro
+      - ./secrets/app/auth0-ocr-client-secret.txt:/run/secrets/auth0-ocr-client-secret:ro
+      - ./secrets/app/google-wif-config.json:/run/secrets/google-wif-config.json:ro
 
   # ========================================
   # PostgreSQL (Staging - Separate Database)