fix(ci): cache OCR Docker layers in backend builds

[pionxe]

Summary

• Use Buildx/GitHub Actions cache for the existing ocr-base Docker stage.
• Run OCR runtime smoke checks when OCR inputs or CI workflows change.
• Warm the OCR cache on main when OCR build inputs change.

Validation

• actionlint and YAML parsing
• CI path-routing and required-gate simulations
• OCR Docker target build and final-image worker smoke
• PaddleOcrProviderTest (10 tests)

Notes

• Normal backend PRs read the OCR cache but do not write to it.
• Cold or evicted caches may rebuild OCR once; this is a performance fallback, not a runtime behavior change.

Close #144

[fennoai]

The workflow routing and Docker smoke-check changes are coherent, but the new main cache-warming path cannot reliably publish the cache with its current token permissions. The fixed-range diff was checked with git diff --check; the remaining issue is the missing permission required by the cache-to: type=gha export.

[fennoai]

[P1] Grant permission to export the BuildKit cache

This workflow declares only contents: read, but the cache-to: type=gha exporter writes through the GitHub Actions cache service and requires write access. On every matching push to main, the build can complete and then fail while exporting the cache, so the intended warm cache is never populated and subsequent PR builds repeatedly fall back to the cold OCR build. Grant the workflow/job the required Actions cache write permission (or otherwise configure the cache service authorization) before relying on this warmer.

[HansonL622]

LGTM