fix(PROJ-35): OCR Tempdir auf storage_dir umleiten

Mit systemd ProtectSystem=strict ist /tmp fuer den Service read-only.
ocr.SetTempDir(storage_path/ocr-tmp) nutzt einen RW-Pfad innerhalb der
ohnehin freigegebenen ReadWritePaths.

internal/ocr/ocr.go

@@ -33,6 +33,25 @@ var (
 	ErrUnavailable = errors.New("ocr: tesseract or pdftotext not available")
 )
 
+// tempDirRoot may be overridden by callers (e.g. when the systemd unit
+// restricts /tmp). Empty string means "use the OS default" via os.MkdirTemp.
+var tempDirRoot = ""
+
+// SetTempDir overrides the parent directory used for temporary OCR work.
+// When dir is empty, the OS default ($TMPDIR or /tmp) is used.
+// Safe to call once at startup; not safe for concurrent reconfiguration.
+func SetTempDir(dir string) {
+	tempDirRoot = dir
+}
+
+func mkTempDir() (string, error) {
+	if tempDirRoot != "" {
+		_ = os.MkdirAll(tempDirRoot, 0o755)
+		return os.MkdirTemp(tempDirRoot, "archivmail-ocr-*")
+	}
+	return os.MkdirTemp("", "archivmail-ocr-*")
+}
+
 // IsAvailable reports whether at least one OCR tool is on PATH.
 // pdftotext alone enables text extraction from native PDFs;
 // tesseract enables OCR for images and scanned PDFs.
@@ -128,7 +147,7 @@ func classify(contentType, filename string) fileKind {
 // ── PDF extraction (pdftotext → tesseract fallback) ───────────────────────
 
 func extractPDF(ctx context.Context, data []byte, langs []string) (string, error) {
-	tmp, err := os.MkdirTemp("", "archivmail-ocr-*")
+	tmp, err := mkTempDir()
 	if err != nil {
 		return "", fmt.Errorf("ocr: tempdir: %w", err)
 	}
@@ -214,7 +233,7 @@ func extractImage(ctx context.Context, data []byte, filename string, langs []str
 	if _, err := exec.LookPath("tesseract"); err != nil {
 		return "", ErrUnavailable
 	}
-	tmp, err := os.MkdirTemp("", "archivmail-ocr-*")
+	tmp, err := mkTempDir()
 	if err != nil {
 		return "", fmt.Errorf("ocr: tempdir: %w", err)
 	}