fix(ocr): review pass — min-ada floor regression test, auth-before-parse, failure-path reconciliation, disclosure label coverage

Fixes 2 critical, 2 important, and 5 minor findings from review of 069edcb:

- C1: add a happy-path test that reaches postOcrEscrow.ts's escrowLockFloor
  call and asserts the locked amount; verified it fails against a bare
  economicTotal and passes against the real code.
- C2: gate /v1/ocr/extract (auth + rate limits) before the 16mb body parser
  so an unauthenticated caller can no longer force a full buffer/JSON.parse.
- I2: hoist result/used/escrowRef in the OCR one-shot handler so the failure
  path records escrow_ref/supplier/cost when an escrow was actually posted,
  and emit an ocr_failed structured log line mirroring ocr_settled.
- I3: export venueAttribution and cover its sanitization directly; add a
  stubbed happy-path route test asserting the first-party-brokered
  disclosure label reaches the response.
- Minor: drop unused hfWeightsSource end to end, rename a misleading test,
  make the OCR capability template's pinning language conditional on the
  self-hosted upstream, tighten the /v1/ocr path-prefix guard, and make
  preflight's required_lovelace use the same escrowLockFloor the builder
  locks (exported from the shared tx barrel for gateway use).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/supplier-routes-ocr.test.ts

@@ -138,7 +138,7 @@ describe("POST /v1/ocr/extract — header + body validation", () => {
 });
 
 describe("POST /v1/ocr/extract — revision-probe gate", () => {
-  it("503 revision_probe_failed when the probe cannot reach the runtime", async () => {
+  it("503 advert_unavailable — chain validation runs before the revision probe fires", async () => {
     // Advert/escrow would resolve AFTER the probe? No — probe runs at step
     // 7.5, after chain checks. Seeding a full escrow in the mock provider is
     // the chat-route suite's job; here we assert the config gate wiring by