feat(ocr): T7-T9 — config overrides + engine factory + signature cascade

T7: OcrCfg gains det_model/rec_model/dict overrides + score_thresh/
unclip_ratio/max_boxes (serde default, KEBAB_IMAGE_OCR_* env). OnnxPaddleOcr::new
threads them via ModelPaths::from_config.
T8: build_image_ocr_engine / build_pdf_ocr_engine factories return
Box<dyn OcrEngine>; match on engine string (ollama-vision|paddle-onnx|err).
ImagePipeline.ocr_engine + pdf_ocr_engine signatures switched to &dyn OcrEngine.
OcrEngine gains model() for the progress label.
T9: ingest_config_signature image/pdf branches emit |ocr:1:{engine}:{engine_version}
(memoized blake3 per asset-triple, m3-safe). Unit tests (a)(b)(c) added.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/kebab-app/tests/common/mock_ocr.rs

@@ -39,6 +39,10 @@ impl OcrEngine for MockOcrEngine {
         "mock-v1".to_string()
     }
 
+    fn model(&self) -> &str {
+        "mock-model"
+    }
+
     fn recognize(&self, _img: &[u8], _hint: Option<&Lang>) -> Result<OcrText> {
         if self.fail {
             anyhow::bail!("mock failure");