Enrich Tick

Run one AI-opener enrichment tick (LeadEnrichmentService.run_tick).

Driven by .github/workflows/enrichment-cron.yml (prod, every 15 min). This REPLACES the in-process APScheduler IntervalTrigger(minutes=15) job enrich_pending_leads: interval triggers inside crm-api reset on every Railway replica restart and silently never fire (2026-08-18 enrollment stall), and enrichment had already frozen once for two weeks (Aug 4-18) with nothing visibly wrong. An external cron fails LOUDLY in GitHub Actions instead.

AUTHED with X-Cron-Token, unlike /enroll-tick: every call spends money (Anthropic + enrichment providers). The daily budget breaker would cap the damage, but an anonymous caller could still burn the whole daily budget in a few requests and starve the real tick.

Gates — all unchanged from the scheduler path:

• OUTREACH_ENABLED (settings.outreach_enabled) — the scheduler's master switch; when false the in-process job was never registered, so this endpoint no-ops too.
• DB feature flag outbound_enrichment_enabled (kill switch), OUTBOUND_ENRICHMENT_TICK_ENABLED env, and the fail-closed daily budget breaker OUTBOUND_ENRICHMENT_DAILY_BUDGET_CENTS — all enforced inside run_tick.
• Concurrency: leads are claimed with FOR UPDATE SKIP LOCKED and flipped to in_progress (db.claim_leads_for_enrichment), so an overlapping manual call or a slow previous tick can never enrich the same lead twice.