fix(ocr): round-2 review — lazy store lock, mode enum normalization, type hints

Round 2 review (PR #910):
- BLOCKING: BatchOcrJobStore._shared_lock is now lazy-init (anyio.Lock | None,
  created on first shared() call) instead of at class-definition time — matches
  the CLAUDE.md "no anyio primitives at import time" rule and OcrProcessor's
  pattern. The None-check->assign has no await between, so it's race-free.
- document_ocr_mode now normalizes via _enum_fields (case-insensitive, like
  document_ocr_provider) instead of a strict dynaconf is_in Validator, so
  DOCUMENT_OCR_MODE=Batch normalizes to "batch" rather than erroring. Tests for
  case-normalization + invalid-value rejection.
- TYPE_CHECKING-gated GatewayBatchOcrClient import so build_gateway_batch_client
  / _get_batch_client are typed `GatewayBatchOcrClient | None` instead of Any
  (runtime import stays lazy to avoid the import cycle).
- Rename ocr_options -> doc_identity_options (it's threaded to all tiers; only
  OCR reads it) + clarify the comment.
- Drop the redundant forward-ref quotes on _shared_instance.
- Add direct _batch_identity unit tests (partial/empty options branches).

Left as follow-up: reusing one httpx.AsyncClient across submit/poll (same
per-call pattern as the existing sync _GatewayOcrBackend; no clean aclose hook
on the cached client today).

1653 unit tests pass; ruff + ty green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/vector/batch_ocr_store.py

@@ -38,18 +38,24 @@ class BatchOcrJob:
 class BatchOcrJobStore:
     """CRUD for the ``batch_ocr_jobs`` table (one row per in-flight job)."""
 
-    _shared_instance: "BatchOcrJobStore | None" = None
-    _shared_lock: anyio.Lock = anyio.Lock()
+    _shared_instance: BatchOcrJobStore | None = None
+    # Lazy-init: anyio primitives must not be created at import time (CLAUDE.md;
+    # mirrors OcrProcessor._backend_lock). Created on first shared() call.
+    _shared_lock: anyio.Lock | None = None
 
     def __init__(self, storage: RefreshTokenStorage) -> None:
         self._storage = storage
 
     @classmethod
-    async def shared(cls) -> "BatchOcrJobStore":
-        """Process-wide store backed by the storage singleton (mirrors
-        ``UsageEventStore.shared``). Tests should construct
-        ``BatchOcrJobStore(storage)`` directly — the cache is a process global
-        with no teardown hook."""
+    async def shared(cls) -> BatchOcrJobStore:
+        """Process-wide store backed by the storage singleton. Tests should
+        construct ``BatchOcrJobStore(storage)`` directly — the cache is a process
+        global with no teardown hook."""
+        # No await between the None-check and the assignment, so this is atomic
+        # within the single event loop (anyio is cooperative) — two cold-start
+        # callers can't both create a lock.
+        if cls._shared_lock is None:
+            cls._shared_lock = anyio.Lock()
         async with cls._shared_lock:
             if cls._shared_instance is None:
                 cls._shared_instance = cls(await get_shared_storage())