feat: add OcrClient.parse_document with full governance

Reuses the existing retry, breaker, limiter and telemetry loop; the transport capability is checked once before the statistics boundary. Legacy entrances keep their error text. Tests cover the document path through the real transport so parser exceptions, deadlines and probe bookkeeping are proven end to end.

tests/unit/test_monkey_document.py

@@ -23,6 +23,7 @@ from polygateway.types import OcrDocumentElement
 from tests.unit._document_fixtures import (
     _BBOX,
     _body,
+    _encrypted_package,
     _image_block,
     _package,
     _page,
@@ -408,16 +409,6 @@ def _patch_first_member_compression(zip_bytes: bytes, method: int) -> bytes:
     return bytes(data)
 
 
-def _encrypted_zip() -> bytes:
-    buf = io.BytesIO()
-    with zipfile.ZipFile(buf, "w") as zf:
-        info = zipfile.ZipInfo("doc_middle.json")
-        info.flag_bits |= 0x1  # 加密位:读取时 zipfile 要求密码
-        zf.writestr(info, b'{"pdf_info": []}')
-        zf.writestr("doc.md", "x")
-    return buf.getvalue()
-
-
 class TestExternalDataExceptionBoundary:
     """外部字节引起的一切已知异常都归 `ResultInvalidError`,绝不漏出原生异常。
 
@@ -427,7 +418,7 @@ class TestExternalDataExceptionBoundary:
 
     def test_encrypted_member(self):
         with pytest.raises(ResultInvalidError):
-            parse_document_package(_encrypted_zip())
+            parse_document_package(_encrypted_package())
 
     def test_unknown_compression_method(self):
         patched = _patch_first_member_compression(_package([_page([])]), 99)