feat: OSCBR token support, Cosmos out of the active chain, quota-safe OSCBR backfill (dry-run selection), provider env passthrough; 1.3.3 (Hub only)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/hub/.env.example

@@ -1,5 +1,5 @@
 # GTI Fiscal Hub — production environment (copy to .env, never commit .env)
-GTI_FISCAL_VERSION=1.3.2
+GTI_FISCAL_VERSION=1.3.3
 
 # REQUIRED. URL-safe secret (used inside a connection URL): openssl rand -hex 24
 POSTGRES_PASSWORD=
@@ -45,3 +45,12 @@ FISCAL_INTERNAL_API_TOKEN=
 BACKUP_DIR=./backups
 # Max whole-database jobs (INITIAL_SYNC / REPROCESS_ALL) running at once across all Agents; others queue as PENDING. <=0 disables.
 HEAVY_JOB_CONCURRENCY_LIMIT=3
+
+# Product-enrichment providers (free plans) - fill on the SERVER only, never commit values
+OSCBR_TOKEN=
+OSCBR_USER=
+OSCBR_PASSWORD=
+KODEBAR_API_KEY=
+COSMOS_ENABLED=0
+OSCBR_BACKFILL_ENABLED=0
+PROVIDER_OPERATIONAL_RESERVE_PERCENT=20