fix: close pypdfium2 page handle on error + cover classifier/OCR edge cases

Follow-up to the tiered document processor (#858), landing the round-4 review
nits the reviewer approved without:

- pypdfium2_fast: free the page handle in an outer finally so a corrupt page
  that makes get_textpage() raise can't orphan it.
- test: classify_from_text junk-text-layer path (non-zero chars, low quality,
  high ocr_frac) flags bad_text_layer -- the hot-path coverage gap.
- test: build_ocr_backend raises ValueError when the gateway M2M client_id is
  set without its token_url/secret.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/test_ocr_processor.py

@@ -71,6 +71,19 @@ def test_build_backend_auto_none_configured():
     assert ocr.build_ocr_backend(_settings()) is None
 
 
+def test_build_backend_gateway_missing_m2m_raises():
+    # client_id set but token_url/secret missing -> explicit ValueError (not a
+    # stripped assert), surfaced on backend resolution.
+    with pytest.raises(ValueError, match="EMBEDDING_GATEWAY_TOKEN_URL"):
+        ocr.build_ocr_backend(
+            _settings(
+                document_ocr_provider="gateway",
+                embedding_gateway_url="http://gw",
+                embedding_gateway_client_id="cid",
+            )
+        )
+
+
 def test_gateway_backend_url_normalization():
     b = ocr._GatewayOcrBackend("http://gw", "mistral/mistral-ocr-latest")
     assert b._url == "http://gw/v1/ocr"