fix(ocr): review pass — min-ada floor regression test, auth-before-parse, failure-path reconciliation, disclosure label coverage

Fixes 2 critical, 2 important, and 5 minor findings from review of 069edcb:

- C1: add a happy-path test that reaches postOcrEscrow.ts's escrowLockFloor
  call and asserts the locked amount; verified it fails against a bare
  economicTotal and passes against the real code.
- C2: gate /v1/ocr/extract (auth + rate limits) before the 16mb body parser
  so an unauthenticated caller can no longer force a full buffer/JSON.parse.
- I2: hoist result/used/escrowRef in the OCR one-shot handler so the failure
  path records escrow_ref/supplier/cost when an escrow was actually posted,
  and emit an ocr_failed structured log line mirroring ocr_settled.
- I3: export venueAttribution and cover its sanitization directly; add a
  stubbed happy-path route test asserting the first-party-brokered
  disclosure label reaches the response.
- Minor: drop unused hfWeightsSource end to end, rename a misleading test,
  make the OCR capability template's pinning language conditional on the
  self-hosted upstream, tighten the /v1/ocr path-prefix guard, and make
  preflight's required_lovelace use the same escrowLockFloor the builder
  locks (exported from the shared tx barrel for gateway use).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

supplier/.env.chandra.example

@@ -52,7 +52,6 @@ OPENAI_TIMEOUT_MS=120000          # page inference is seconds; keep < advert max
 # openai-vision upstream only (attestation upgrade path):
 # OCR_PROMPT_OVERRIDE=            # exact serving prompt, pinned at integration
 # HF_MODEL_REVISION=              # 40-hex checkpoint SHA; mismatch refuses Claim
-# HF_WEIGHTS_SOURCE=hf:datalab-to/chandra-ocr-2
 # REVISION_PROBE_URL=             # e.g. http://chandra-vllm:8000/info
 
 # ── Service ───────────────────────────────────────────────────────────────