feat(ocr): Tesseract.js as default scanner, AI as opt-in per port

The mobile receipt scanner now runs Tesseract.js in-browser by default —
on-device, free, and image bytes never leave the device. AI providers
(OpenAI / Claude) become a per-port opt-in for higher accuracy on
hard-to-read receipts.

- Lazy-load Tesseract WASM in src/lib/ocr/tesseract-client.ts (5 MB
  bundle dynamic-imports on first scan, not in main chunk)
- Heuristic parser src/lib/ocr/parse-receipt-text.ts extracts vendor,
  date, amount, currency, and line items from raw OCR text
- New port-scoped aiEnabled flag on OcrConfig (defaults false). Resolved
  flag never inherits from the global row — each port admin opts in
  independently
- Scan endpoint short-circuits to manual-mode when aiEnabled=false so
  the AI provider is never invoked unless the admin has flipped the
  switch
- Scan UI runs Tesseract first, then asks the server whether AI is
  enabled — uses the AI result only when its confidence beats Tesseract;
  network failures degrade gracefully to the local parse
- Admin OCR-settings form gains the per-port aiEnabled checkbox

Tests: 756/756 vitest (was 747) — +7 parser unit tests, +2 aiEnabled
config tests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/api/v1/admin/ocr-settings/route.ts

@@ -14,6 +14,7 @@ const saveSchema = z.object({
   apiKey: z.string().optional(),
   clearApiKey: z.boolean().optional(),
   useGlobal: z.boolean().optional(),
+  aiEnabled: z.boolean().optional(),
 });
 
 export const GET = withAuth(async (req, ctx) => {
@@ -51,6 +52,7 @@ export const PUT = withAuth(async (req, ctx) => {
         apiKey: body.apiKey,
         clearApiKey: body.clearApiKey,
         useGlobal: body.useGlobal,
+        aiEnabled: body.aiEnabled,
       },
       ctx.userId,
     );

src/app/api/v1/expenses/scan-receipt/route.ts

@@ -27,9 +27,16 @@ export const POST = withAuth(
       const mimeType = file.type || 'image/jpeg';
 
       const config = await getResolvedOcrConfig(ctx.portId);
+      // Tesseract.js (in-browser) is the default. The server only invokes
+      // an AI provider when (a) the port admin has flipped `aiEnabled` on
+      // and (b) a key resolves. Otherwise the client falls back to its
+      // local Tesseract result.
+      if (!config.aiEnabled) {
+        return NextResponse.json({
+          data: { parsed: EMPTY, source: 'manual', reason: 'ai-disabled' },
+        });
+      }
       if (!config.apiKey) {
-        // Manual-entry path — no OCR configured. Frontend will show the
-        // verify form with empty fields so the user can fill it in.
         return NextResponse.json({
           data: { parsed: EMPTY, source: 'manual', reason: 'no-ocr-configured' },
         });