feat: OSCBR token support, Cosmos out of the active chain, quota-safe OSCBR backfill (dry-run selection), provider env passthrough; 1.3.3 (Hub only)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

central/scripts/oscbr_backfill.py

@@ -0,0 +1,41 @@
+"""Verify a small, prioritised sample of CORROBORATED GTINs with OSCBR (free plan). Credentials come ONLY from the Hub environment (OSCBR_TOKEN or OSCBR_USER/OSCBR_PASSWORD).
+
+    python -m central.scripts.oscbr_backfill --limit 20 [--dry-run] [--report out.json]
+
+Never spends the operational reserve (PROVIDER_OPERATIONAL_RESERVE_PERCENT), respects 5/min and 50/day, and never queries VERIFIED_KB, CONFLICT or invalid GTINs.
+"""
+import argparse
+import json
+import sys
+
+from central.app.config import settings
+from central.app.db import SessionLocal
+from central.app.enrichment import backfill, history
+from central.app.enrichment.providers import build_providers
+from central.app.enrichment.quota import ProviderGateway
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--limit", type=int, default=20)
+    ap.add_argument("--dry-run", action="store_true")
+    ap.add_argument("--report", default=None)
+    args = ap.parse_args(argv)
+    providers = build_providers(settings)
+    oscbr = next(p for p in providers if p.name == "oscbr")
+    if not oscbr.configured and not args.dry_run:
+        print(json.dumps({"OSCBR_STATUS": "NOT_CONFIGURED", "requests": 0}))
+        return 2
+    with SessionLocal() as session:
+        current = history.official_sets(session)
+        report = backfill.run(session, ProviderGateway(session, [oscbr]), oscbr, limit=args.limit, reserve_percent=settings.provider_operational_reserve_percent,
+                              is_official=lambda v: v in current, dry_run=args.dry_run)
+    text = json.dumps(report, indent=1, default=str)
+    if args.report:
+        open(args.report, "w", encoding="utf-8").write(text)
+    print(text)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())