Process inbound emails into tickets (GET)

Added by HO-8159. Drives the bounded inbound-email worker: claims inbound_emails rows that are received or processing with an EXPIRED five-minute lease, routes each to one accessible project, creates the ticket and sends the sender a receipt. The Mailgun intake route (POST /inbound-email) persists an email and returns 200 without routing it, so nothing else turns a ledger row into a ticket. At most three attempts per email; past the ceiling the row is terminal processing_failed. Bounds are overridable per environment with INBOUND_EMAIL_SWEEP_LIMIT (default/max 25 rows) and INBOUND_EMAIL_SWEEP_DEADLINE_MS (default 45000). Protected by CRON_SECRET via the x-cron-secret header ONLY — a token query parameter is rejected (secrets do not belong in URLs).