feat(ocr): discard abandoned capture batches

A bad scan, the wrong PDFs or a duplicate upload used to leave a batch
sitting in READY_FOR_REVIEW forever, because the only exits were confirm
(posts to the books) or rejecting every page one at a time. Add a
DISCARDED terminal status to both OCR domains and a single endpoint per
domain that rejects every page still pending in one shot.

Discarding is refused once anything has landed: statements once a page is
POSTED, policies once a page is APPLIED. Those batches did real work and
have to be settled page by page.

- POST /statements/batches/:id/discard
- POST /policy-ocr/batches/:id/discard
- shared DiscardBatchCard on both review screens, gated the same way

apps/web/src/components/PolicyOcrIntake.tsx

@@ -30,6 +30,7 @@ const STATUS_LABEL: Record<PolicyOcrBatchStatus, string> = {
   READY_FOR_REVIEW: "Listo para revisar",
   COMPLETED: "Aplicado",
   FAILED: "Falló",
+  DISCARDED: "Descartado",
 };
 
 export function PolicyOcrIntake() {