refactor(papers): use opencite for paper sync + declare dependency

[neuromechanist]

Summary

Replaces the homegrown paper fetch layer in papers_sync.py with neuromechanist/opencite (the maintained successor this code inspired), and declares it as a dependency so GitHub's dependency graph attributes OSA under opencite's dependents.

Closes #307. Scope: sync/fetch layer only (per design decision) — the local SQLite + FTS store, upsert_paper, and the search_*_papers tool are unchanged.

What changed

• sync_openalex_papers / sync_semanticscholar_papers / sync_pubmed_papers now restrict an opencite search to that one source; sync_all_papers runs one deduplicated opencite search across (openalex, s2, pubmed) per query (replacing three sequential per-source fetches).
• sync_citing_papers uses opencite's CitationExplorer.citing_papers (no manual OpenAlex-ID lookup step).
• Removed the hand-rolled inverted-index reconstruction and per-source XML/JSON parsing (opencite handles it). Net −101 lines.
• Public signatures unchanged → src/cli/sync.py and src/api/scheduler.py call these functions exactly as before.
• opencite>=0.5.2 added to the server optional-dependencies (+ uv.lock).

Design notes

• Stable identity / dedup: each opencite Paper maps to a (source, external_id) with priority OpenAlex > Semantic Scholar > PubMed > DOI > arXiv, keeping source labels aligned with rows already in the DB.
• Default sources kept conservative (openalex, s2, pubmed) so batch coverage matches prior behavior; opencite's broader sources (arxiv/biorxiv/osf/...) are reserved for the opt-in live-search feature (feat(papers): optional live 'search most recent papers' via opencite #308).
• No Config.from_env(): Config is built directly from OSA-supplied keys, so sync never depends on ambient .env files (opencite's dotenv loader raised OSError on OSA's .env). Keys flow from OSA settings exactly as before; configure_openalex() is retained for the CLI's configure-once pattern.

Tests

• Real opencite Paper objects (no mocks) cover the source/ID/URL mapping and _store_papers against a real SQLite DB (labels, dedup, skip-no-id, forced-source).
• Network smoke tests confirm opencite fetches from OpenAlex end-to-end.
• 245 knowledge + 20 scheduler + CLI sync tests pass; ruff clean.

Follow-ups (separate issues)

• feat(papers): optional live 'search most recent papers' via opencite #308 — optional live 'search most recent papers' on top of this opencite client.

Closes #307

[neuromechanist]

Review (Sonnet, pr-review-toolkit) + resolutions

No critical issues. Mapping logic, DB-constraint compliance (url NOT NULL, created_at types), Config construction with empty-string keys, error recovery, public-API stability, and import resolution all confirmed solid.

Both 'important' findings addressed (no tech debt carried forward):

1. One orchestrator per query was wasteful (each open spins up 11 HTTP clients). sync_all_papers/sync_citing_papers now open a single SearchOrchestrator/CitationExplorer for the whole batch and loop queries/DOIs inside it, with per-item error isolation so one bad query/DOI doesn't abort the batch.
2. asyncio.run would raise inside a running loop (latent fragility). Added a _run() helper that uses asyncio.run normally but offloads to a worker thread when a loop is already running, so the public sync functions are safe from any context. Tested both paths (no-loop and running-loop).

50 scheduler + CLI sync, 23 offline mapping/run, and 2 network smoke tests pass; ruff clean.