feat: OSCBR token support, Cosmos out of the active chain, quota-safe OSCBR backfill (dry-run selection), provider env passthrough; 1.3.3 (Hub only)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

central/app/config.py

@@ -79,6 +79,9 @@ class Settings:
     ai_base_url: str = os.getenv("AI_BASE_URL", "https://api.z.ai/api/paas/v4")
     # ---- Product enrichment (docs/product_enrichment.md): free providers only, tokens live ONLY in the Hub environment ----
     cosmos_token: str = os.getenv("COSMOS_TOKEN", "")          # optional; without it Cosmos is NOT_CONFIGURED (not an error)
+    oscbr_token: str = os.getenv("OSCBR_TOKEN", "")            # preferred: a ready Bearer token instead of the login
+    cosmos_enabled: bool = os.getenv("COSMOS_ENABLED", "0") == "1"   # Cosmos stays out of the active chain unless explicitly enabled
+    oscbr_backfill_enabled: bool = os.getenv("OSCBR_BACKFILL_ENABLED", "0") == "1"   # gradual backfill of CORROBORATED GTINs; OFF until a real benchmark proves value
     oscbr_user: str = os.getenv("OSCBR_USER", "")              # optional free-plan account of gtin.rscsistemas.com.br (never in logs/UI)
     oscbr_password: str = os.getenv("OSCBR_PASSWORD", "")
     kodebar_api_key: str = os.getenv("KODEBAR_API_KEY", "")     # optional free-plan key (identity only); never in logs/UI