feat(labs-ocr): read PDFs on the configured provider, retire the separate scan provider

Lab-report OCR now rasterizes a PDF to page images for any non-Anthropic
vision provider, exactly as the document vault already does — Anthropic keeps
its native PDF block, every other vision provider (codex/OAuth, OpenAI, local)
reads the rendered pages. The capability probe reports `pdfSupported` whenever
the picked provider reads PDFs natively or the server-side rasterizer is
available, so the "scan a PDF" affordance shows for a codex provider too.

Drop the dedicated document-scan (Lab-OCR) provider: labs OCR always uses the
main configured provider chain. Removes the settings card, the `aiOcr*`
resolution branch, the GET/PATCH handler fields, the OpenAPI schema fields, the
i18n keys across all locales, and the five backing `User` columns (migration
0234). The on-device tesseract fallback is untouched.

Dashboard hero: stack the overdue-dose action directly beneath the verdict
text (tight gap, left-aligned) on every viewport instead of pushing it to the
far container edge on desktop.

docs/api/openapi.yaml

@@ -7612,13 +7612,14 @@ paths:
         - Labs
       summary: Extract lab readings from a photo, PDF, or OCR'd text
       description: "Read-only (NOT idempotent) extraction. Two modes by content-type. VISION (`multipart/form-data`): a `file`
-        (JPEG/PNG/WebP, or PDF on an Anthropic vision provider; ≤ 12 MiB) is run through the user's vision-capable
-        provider; the upload lives in memory only and is never persisted or logged. TEXT (`application/json`, opt-in
-        local OCR): the browser OCR's the image (tesseract.js) and POSTs `{ mode: \"text\", text }` — only the extracted
-        text reaches the server, so a text-only provider (e.g. ChatGPT-OAuth) reaches the same review/commit flow. Both
-        modes are gated by AI consent, a 6/hour rate bucket, and the per-day token budget, and return proposed rows for
-        the mandatory human review screen — nothing is written. Extracted content is treated as untrusted
-        (prompt-injection); the review step is the safety boundary."
+        (JPEG/PNG/WebP, or PDF — read natively on Anthropic, else rasterized to page images for any other vision
+        provider; ≤ 12 MiB) is run through the user's vision-capable provider; the upload lives in memory only and is
+        never persisted or logged. TEXT (`application/json`, opt-in local OCR): the browser OCR's the image
+        (tesseract.js) and POSTs `{ mode: \"text\", text }` — only the extracted text reaches the server, so a text-only
+        provider (e.g. ChatGPT-OAuth) reaches the same review/commit flow. Both modes are gated by AI consent, a 6/hour
+        rate bucket, and the per-day token budget, and return proposed rows for the mandatory human review screen —
+        nothing is written. Extracted content is treated as untrusted (prompt-injection); the review step is the safety
+        boundary."
       requestBody:
         required: true
         content:
@@ -18492,35 +18493,6 @@ components:
             - type: "null"
           description: v1.22 (#89) — per-user response timeout for AI generation, in seconds (10–600). Null = the built-in
             comprehensive-briefing default (~120 s). Mainly for slow local/self-hosted backends.
-        ocrEnabled:
-          type: boolean
-          description: v1.22 (#90) — whether a dedicated document-scan (Lab-OCR) provider is active. When false the OCR path uses
-            the main provider chain.
-        ocrProvider:
-          anyOf:
-            - type: string
-              enum:
-                - OPENAI
-                - ANTHROPIC
-                - LOCAL
-            - type: "null"
-          description: The dedicated document-scan provider, or null when unset.
-        ocrModel:
-          anyOf:
-            - type: string
-            - type: "null"
-        ocrBaseUrl:
-          anyOf:
-            - type: string
-            - type: "null"
-          description: Custom base URL (LOCAL OCR provider only); null otherwise.
-        hasOcrKey:
-          type: boolean
-        ocrKeyPreview:
-          anyOf:
-            - type: string
-            - type: "null"
-          description: "`...` + last 4 chars of the stored document-scan provider key, or null."
       required:
         - provider
         - model
@@ -18533,12 +18505,6 @@ components:
         - hasOpenaiKey
         - openaiKeyPreview
         - responseTimeoutSeconds
-        - ocrEnabled
-        - ocrProvider
-        - ocrModel
-        - ocrBaseUrl
-        - hasOcrKey
-        - ocrKeyPreview
       additionalProperties: false
       description: The calling user's AI-provider configuration plus the effective availability (`aiAvailable` + `managedBy`).
         Reports key presence + a masked preview only — never a plaintext key.
@@ -25372,8 +25338,8 @@ components:
       description: Whether the caller's configured AI provider can ingest a lab report (drives the UI's scan affordance).
         `mode` is `vision` when the provider reads the image directly, `text` when the image is OCR'd in-browser and
         only the extracted text is sent (opt-in local OCR for text-only providers), or null when unavailable. `reason`
-        explains an unavailable state; `pdfSupported` is true only for an Anthropic vision provider (native PDF). No
-        provider call is made.
+        explains an unavailable state; `pdfSupported` is true when the provider reads PDFs natively (Anthropic) or the
+        server-side rasterizer can render the pages for any other vision provider. No provider call is made.
     OcrExtractEnvelope:
       type: object
       properties: