Drain native balance to a destination address (works on suspended wallets)

Drain the wallet's entire native-token balance to a destination address. Works on suspended wallets — the safety valve, so a project whose allowance runs out can still recover its on-chain funds. Project lifecycle must still allow control-plane writes. Header X-Confirm-Drain: <signer_id> required. Optional Idempotency-Key is request-fingerprinted; mismatched replays return 409 carrying the stored call's status/call_error/tx_hash, and a matched replay of a drain that failed before broadcast re-executes under the same call_id. Cost: chain gas at-cost + $0.000005 signing fee.