feat: extract OCR worker into separate service

- Remove Python/OCR steps from backend.Dockerfile (builder + runtime)
- Remove Python/OCR steps from backend-dev.Dockerfile
- Add OCR_BASE_URL env var to both Dockerfiles (http://ocr-worker:8100)
- Add ocr-worker service to docker-compose.yml with healthcheck
- Add ocr-worker service to docker-compose.dev.yml with healthcheck + port
- Update backend depends_on in both compose files to include ocr-worker
- Replace OCR_PROJECT_ROOT with OCR_BASE_URL in compose env vars
- Remove pip install line from start-dev-container.sh

deploy/docker/backend-dev.Dockerfile

@@ -1,15 +1,14 @@
-# Dev Dockerfile — single-stage, root, VNC/X11 + Playwright + OCR
+# Dev Dockerfile — single-stage, root, VNC/X11 + Playwright
 # For production, see backend.Dockerfile (multi-stage build)
 FROM node:22-bookworm
 
 ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
 ARG NPM_REGISTRY=https://registry.npmmirror.com
-ARG UV_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV TZ=Asia/Shanghai
 ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
-ENV PIP_INDEX_URL=${UV_INDEX_URL}
+ENV OCR_BASE_URL=http://ocr-worker:8100
 ENV NPM_CONFIG_REGISTRY=${NPM_REGISTRY}
 
 WORKDIR /app
@@ -20,7 +19,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
   && sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
   && apt-get update \
   && apt-get install -y --no-install-recommends \
-       curl ca-certificates python3 python3-pip tzdata \
+       curl ca-certificates tzdata \
        xauth x11vnc novnc websockify xvfb \
   && ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime \
   && echo ${TZ} > /etc/timezone
@@ -34,10 +33,6 @@ RUN --mount=type=cache,target=/ms-playwright-cache,sharing=locked \
     npx playwright install --with-deps chromium \
   && cp -r /ms-playwright-cache /ms-playwright
 
-COPY apps/backend/subservices/ocr-worker/ ./subservices/ocr-worker/
-RUN --mount=type=cache,target=/root/.cache/pip,sharing=locked \
-    python3 -m pip install --break-system-packages ./subservices/ocr-worker
-
 COPY apps/backend/ ./
 
 RUN mkdir -p /app/data /app/data/browser-sessions /app/data/redeem-screenshots