Fire the buyer-feedback rating email.

Body: {"to": "test|all", "send": bool} to="test" → sends [TEST] copy to feedback_sender.TEST_RECIPIENT only to="all" → every live swing-logic buyer, resolved from customers.jsonl

A request that does not ask to send performs a DRY RUN and returns the plan. Sending needs an explicit {"send": true} (or ?send=true); {"dry_run": false} is still honoured for callers written against the old shape. This endpoint deliberately does NOT use _dry_run_from(), which defaults to a real send — right for an idempotent digest, wrong for a one-shot campaign to a buyer list, where the cost of an accidental send is a duplicate ask to real customers that cannot be recalled. Same default as tools/send_feedback.py (dry_run = not args.send). PD-327.

This is the sanctioned path for running the campaign: the credential lives in the service (OGT_GMAIL_APP_PASSWORD from Secret Manager), so a caller needs only the cron secret and never handles the mail identity.

Auth: X-Cron-Secret header OR admin Basic auth.