feat: OSCBR token support, Cosmos out of the active chain, quota-safe OSCBR backfill (dry-run selection), provider env passthrough; 1.3.3 (Hub only)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/hub/docker-compose.prod.yml

@@ -36,7 +36,7 @@ services:
     build:
       context: ../..
       dockerfile: central/Dockerfile
-    image: gti-fiscal-hub:${GTI_FISCAL_VERSION:-1.3.2}
+    image: gti-fiscal-hub:${GTI_FISCAL_VERSION:-1.3.3}
     restart: unless-stopped
     depends_on:
       postgres:
@@ -45,6 +45,14 @@ services:
       APP_ENV: production
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
       LOG_LEVEL: ${LOG_LEVEL:-INFO}
+      # Product-enrichment providers (free plans). Secrets live ONLY in deploy/hub/.env on the server (never committed, never in the Agent/installer/panel/logs).
+      OSCBR_TOKEN: ${OSCBR_TOKEN:-}
+      OSCBR_USER: ${OSCBR_USER:-}
+      OSCBR_PASSWORD: ${OSCBR_PASSWORD:-}
+      KODEBAR_API_KEY: ${KODEBAR_API_KEY:-}
+      COSMOS_ENABLED: ${COSMOS_ENABLED:-0}
+      OSCBR_BACKFILL_ENABLED: ${OSCBR_BACKFILL_ENABLED:-0}
+      PROVIDER_OPERATIONAL_RESERVE_PERCENT: ${PROVIDER_OPERATIONAL_RESERVE_PERCENT:-20}
       BASE_URL: ${BASE_URL:?BASE_URL is required (public HTTPS URL of the Hub)}
       AGENT_ONLINE_THRESHOLD_SECONDS: ${AGENT_ONLINE_THRESHOLD_SECONDS:-120}
       # Reverse proxy on another host: uvicorn only honours X-Forwarded-For/-Proto