fix(ocr): use presigned URLs for MinIO access from OCR service

The OCR service was getting 403 Forbidden because it tried to
download PDFs from MinIO using plain internal URLs without
authentication. MinIO buckets are private.

- Add S3Presigner bean to MinioConfig
- FileService.generatePresignedUrl(): generates 15-min presigned URLs
- OcrService uses presigned URLs instead of plain internal URLs
- Remove unused s3InternalUrl / bucketName @Value fields from OcrService

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ocr-service/main.py

@@ -82,7 +82,7 @@ async def run_ocr(request: OcrRequest):
 
 
 async def _download_and_convert_pdf(url: str) -> list[Image.Image]:
-    """Download a PDF from URL and convert each page to a PIL Image."""
+    """Download a PDF from a presigned URL and convert each page to a PIL Image."""
     async with httpx.AsyncClient(timeout=httpx.Timeout(300.0)) as client:
         response = await client.get(url)
         response.raise_for_status()