ocr: ship an engine in the image, and open the gate in front of it

The OCR pod image installed NO OCR engine — only transformers and pypdfium2. A
pod could boot, pass its health check, accept a request and have nothing to do
it with. Three gates in front of that each reported their own refusal first —
'OCR subsystem is disabled', then 'OCR engine surya is not enabled' — so it took
three rounds to see that the engine was never there.

docTR goes in, because it is the only one of the three that runs in-process.
Surya caps pillow<11 and lives in an isolated venv by design; paddle wants
paddlepaddle in one of its own. Either would put a second torch in the image —
6 GB to avoid a Pillow conflict — and the venv mechanism is there if a pod ever
needs Surya's layout quality specifically.

Each engine also has its own enable flag on top of the subsystem's, and two of
the three default to off. A pod now enables the engine it was asked for, falls
back to docTR when the request names something the image cannot serve, and still
inherits the Surya licence decision from here rather than making it itself.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0182DhR1eFNPQyGmDrpHbedY