Default OCR off for deploy — TrOCR OOM-kills the 512MB Render worker

An OS OOM SIGKILL is uncatchable in Python, so the try/except fallback can't
save it — the worker dies and the request hangs (HTTP 000 / timeout). The only
reliable fix on a 512MB host is to never load TrOCR. Default ocr_enabled=False;
enable locally via OCR_ENABLED=true where RAM is available.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -10,6 +10,11 @@ STOP_LINE_FRAC=0.6
 WRONG_SIDE_ENFORCEMENT=true
 WRONG_SIDE_DIRECTION=down
 
+# ── Plate OCR (TrOCR) ─────────────────────────────────────────────────────
+# OFF by default. Loading TrOCR can exceed a 512MB host's RAM and the OS kills
+# the worker (hangs the request). Only set true on a host with ≥2GB RAM.
+# OCR_ENABLED=true
+
 # ── Illegal parking zones ─────────────────────────────────────────────────
 # JSON array of no-parking polygons. Each polygon is a list of [x, y] fractions
 # of the frame (0.0–1.0, top-left origin). Example marks both road shoulders:

backend/app/config.py

@@ -32,9 +32,12 @@ class Settings(BaseSettings):
     # ~1.4GB for "base" — base OOMs a 512MB host, so small is the deploy default.
     # Use "microsoft/trocr-base-printed" only on a host with ≥2GB RAM.
     trocr_model: str = "microsoft/trocr-small-printed"
-    # Plate OCR is the heaviest stage. Set OCR_ENABLED=false on tiny hosts to
-    # skip it entirely — violations are still detected, just without plate text.
-    ocr_enabled: bool = True
+    # Plate OCR is the heaviest stage — loading TrOCR can exceed a 512MB host's
+    # RAM and the OS SIGKILLs the worker (uncatchable in Python), hanging the
+    # request. So it's OFF by default for safe cloud deploys; violations are
+    # still detected, just without plate text. Set OCR_ENABLED=true on a host
+    # with enough RAM (e.g. your local machine) to read plates.
+    ocr_enabled: bool = False
 
     # Violation rules
     # Helmet/no-helmet detector. The bundled YOLO11 weight emits rider classes