feat: add OcrClient.parse_document with full governance

Reuses the existing retry, breaker, limiter and telemetry loop; the transport capability is checked once before the statistics boundary. Legacy entrances keep their error text. Tests cover the document path through the real transport so parser exceptions, deadlines and probe bookkeeping are proven end to end.

tests/unit/_document_fixtures.py

@@ -69,3 +69,13 @@ def _package(
         for name, data in extra:
             zf.writestr(name, data)
     return buf.getvalue()
+
+
+def _encrypted_package() -> bytes:
+    buf = io.BytesIO()
+    with zipfile.ZipFile(buf, "w") as zf:
+        info = zipfile.ZipInfo("doc_middle.json")
+        info.flag_bits |= 0x1  # 加密位:读取时 zipfile 要求密码
+        zf.writestr(info, b'{"pdf_info": []}')
+        zf.writestr("doc.md", "x")
+    return buf.getvalue()