Drain the ticket embedding outbox

Admin-only embedding outbox drain (HO-14315). Seeds a job for every ticket with neither a vector nor a job, then claims, embeds and settles up to max_tickets outbox jobs from the background budget lane. The Slipstream schedule embedding-drain calls it every ten minutes; a manual call is the same run. Auth via the x-cron-secret header matching CRON_SECRET. The body also carries the global outbox health the schedule fails on (HO-14476). dead_letters runs no drain: it marks every new dead letter handled and, with requeue, gives each dead-lettered ticket a fresh job.