feat(ocr): Tesseract.js as default scanner, AI as opt-in per port

The mobile receipt scanner now runs Tesseract.js in-browser by default —
on-device, free, and image bytes never leave the device. AI providers
(OpenAI / Claude) become a per-port opt-in for higher accuracy on
hard-to-read receipts.

- Lazy-load Tesseract WASM in src/lib/ocr/tesseract-client.ts (5 MB
  bundle dynamic-imports on first scan, not in main chunk)
- Heuristic parser src/lib/ocr/parse-receipt-text.ts extracts vendor,
  date, amount, currency, and line items from raw OCR text
- New port-scoped aiEnabled flag on OcrConfig (defaults false). Resolved
  flag never inherits from the global row — each port admin opts in
  independently
- Scan endpoint short-circuits to manual-mode when aiEnabled=false so
  the AI provider is never invoked unless the admin has flipped the
  switch
- Scan UI runs Tesseract first, then asks the server whether AI is
  enabled — uses the AI result only when its confidence beats Tesseract;
  network failures degrade gracefully to the local parse
- Admin OCR-settings form gains the per-port aiEnabled checkbox

Tests: 756/756 vitest (was 747) — +7 parser unit tests, +2 aiEnabled
config tests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/api/v1/admin/ocr-settings/route.ts

@@ -14,6 +14,7 @@ const saveSchema = z.object({
   apiKey: z.string().optional(),
   clearApiKey: z.boolean().optional(),
   useGlobal: z.boolean().optional(),
+  aiEnabled: z.boolean().optional(),
 });
 
 export const GET = withAuth(async (req, ctx) => {
@@ -51,6 +52,7 @@ export const PUT = withAuth(async (req, ctx) => {
         apiKey: body.apiKey,
         clearApiKey: body.clearApiKey,
         useGlobal: body.useGlobal,
+        aiEnabled: body.aiEnabled,
       },
       ctx.userId,
     );