New `ocr.max_pages`. A document with more pages than the ceiling is refused
with a 413 naming its page count and the limit, instead of being read.

Checked off the page tree, before anything is rendered, split or sent -- so
an over-long document costs milliseconds rather than an hour of time,
memory, tokens and (where pages are read on rented cards) money, only to
die in a client's timeout anyway. Length is the one cost knowable before
any work, and the one that scales every other cost at once.

Shipped OFF (0 = no ceiling). Page count is not a fault: an install that
batch-reads book scans is as legitimate as one that reads two-page letters,
and this product does not know which it is talking to. Settable from the
OCR settings page.

Refused LOUDLY and with both numbers. This subsystem already carries the
trap that a degraded page answers 200; a skipped document that looked like
an empty read would be the same mistake with a bigger blast radius. The
message names the setting so an operator can find it, and says the document
was NOT read so a caller can route it elsewhere rather than file an empty
result.

`max_pages` at exactly the ceiling passes -- "more than N" means N is fine.
A nonsense value fails OPEN: refusing every document would be worse than
the problem.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KnfkxBpcZ1v6ypRFFyhrVM