Poll for print requests that have never been sliced

SLICE_SERVICE_SECRET bearer, polled roughly every 60s by the slicing service. Returns open requests with an attached file and no prior slice attempt; link-only submissions are never auto-sliced. It deliberately does NOT apply the format/material/quantity eligibility gate - that rule lives once, in the slicing service, so this route answers only 'what is new' and the poller decides 'is it eligible'. blob_url is included here, and only here, because this route is machine-to-machine and never client-facing.