fix(ocr): wire batch settings into _field_map + review nits

Round 1 review (PR #910):
- BLOCKING: add document_ocr_mode / _batch_poll_seconds / _batch_max_wait_seconds
  to config._field_map — without it dynaconf silently ignored the env vars and
  DOCUMENT_OCR_MODE=batch could never be enabled in production. Add a regression
  test asserting the three round-trip from env.
- migration 008: give batch_ocr_jobs a composite PRIMARY KEY on
  (user_id, doc_id, doc_type, etag) instead of a bare UniqueConstraint (N1).
- OcrProcessor: use a dedicated _batch_client_lock instead of sharing the sync
  backend lock (N3).
- tests: use https:// gateway URLs in the new fixtures to clear SonarCloud's
  "insecure http" security hotspots (all 14 were test-only http://gw literals).

1653 unit tests pass; ruff + ty green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/test_config.py

@@ -115,6 +115,28 @@ class TestGetSettings:
         assert settings.oidc_token_type == "jwt"
         assert settings.oidc_scopes == "openid profile"
 
+    @patch.dict(
+        os.environ,
+        {
+            "DOCUMENT_OCR_MODE": "batch",
+            "DOCUMENT_OCR_BATCH_POLL_SECONDS": "45",
+            "DOCUMENT_OCR_BATCH_MAX_WAIT_SECONDS": "3600",
+        },
+        clear=True,
+    )
+    def test_get_settings_ocr_batch_mode_from_env(self):
+        """DOCUMENT_OCR_MODE / batch tuning must reach settings (regression).
+
+        These were added to _DEFAULTS + the Settings dataclass but initially
+        omitted from _field_map, so dynaconf silently ignored the env vars and
+        batch mode could never be enabled in production (Deck #332).
+        """
+        _reload_config()
+        settings = get_settings()
+        assert settings.document_ocr_mode == "batch"
+        assert settings.document_ocr_batch_poll_seconds == 45
+        assert settings.document_ocr_batch_max_wait_seconds == 3600
+
     @patch.dict(
         os.environ,
         {"QDRANT_LOCATION": "/app/data/qdrant"},