Sync from GitHub main: parser fixes (SUB-TOTAL, 2-digit qty, barcode strip), ISO dates, conditional second OCR pass, non-blocking model load, OCR_SHARED_SECRET gate + 15MB cap, TIMING behind env var

Reconcile with GitHub repo (diverged since 2026-05-20)

fix(parser): detect Co-op via tagline, BALANCE DUE as total, strip inline qty, filter CREDIT/DEBIT

fix(logging): use print(flush=True) for TIMING lines so they appear in HF logs

revert(ocr): remove invalid det_model parameter

perf(ocr): switch to mobile detection model for faster CPU inference

revert(ocr): restore dual-pass and 4096px, keep timing logs

chore(ocr): add per-step timing logs to identify bottleneck

perf(ocr): halve inference time on free CPU tier

feat: initial OCR server deploy