Migrate drain-email-outbox cron (jobid=6) off inline bearer onto vault cron_auth_header()

cron.job jobid=6 (drain-email-outbox) inlines CRON_SECRET as a plaintext literal in cron.job.command, predating the mig017/MARS-199 vault.decrypted_secrets + cron_auth_header() pattern used by the 4 newer Vercel-replacement crons. Migrate jobid=6 onto cron_auth_header() for consistency + defense-in-depth (no code change, DB-only: CREATE OR REPLACE the reschedule with cron_auth_header() in place of the literal header). Reversible, no data touched. Not urgent, backlog behind MARS-145.