fix(deploy): increase OCR healthcheck start_period, comment ocr_cache volume, add token hint

- start_period 60s → 120s: Zenodo download on cold start can exceed 60s on slow connections
- ocr_cache volume comment: documents what the cache stores for future operators
- .env.example: add token generation command to prevent weak placeholder in production

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -23,6 +23,7 @@ PORT_MAILPIT_SMTP=1025
 
 # OCR Training — secret token required to call /train and /segtrain on the OCR service.
 # Also set in the backend so it can pass the token through. Must not be empty in production.
+# Generate with: python3 -c "import secrets; print(secrets.token_hex(32))"
 OCR_TRAINING_TOKEN=change-me-in-production
 
 # Production SMTP — uncomment and fill in to send real emails instead of catching them