Autopilot Tick

Review every opted-in account's campaigns and act on the results.

Same shared-secret guard as /send/tick, and the same reason: this is a cron target, not something a browser session calls, and a public one would let anyone pause or rebalance an account's campaigns.

This route existing does not by itself mean it runs on a schedule - it has to be wired to an actual scheduler (a Railway cron hitting this endpoint, or equivalent) as a separate deploy step. Calling it directly runs one real review pass right now, which is how it was tested.