Daily sweep: nudge paid orgs that signed up 24h+ ago and never made a call

Daily cron targeting paid orgs that have NEVER used their API key.

Audience (2026-07-10, real-data-driven — found via a live org/usage cross-reference that a paying customer sat unactivated for 2 weeks with no template able to reach them):

• status='active' (skip canceled / past_due / payment_at_risk)
• tier IN ('basic', 'physical', 'pro', 'realtime') — free-tier excluded, same reasoning as win-back's own audience gate (cooling-off is evaluation behavior, not a signal worth a nudge). Deliberately wider than win-back's own tier list (which omits 'realtime' — a pre-existing gap in that older cron, not fixed here; tracked in KNOWN_DEBT.md).
• created_at at least 24h ago (matches dino.markets' proven activation-first-call cadence).
• NO api_keys row for the org has a non-null last_used_at — i.e. every key they've ever held (including a rotated-away one) has never been used even once. A rotated key's OLD row keeps its original last_used_at (rotation never touches it), so this correctly reads "activated" for an org that used a key once then rotated.

Once-ever via FREQUENCY_CAPS (same _WELCOME_ONCE_EVER sentinel as welcome) — a daily re-scan while still unactivated is a cheap no-op once the first send lands. Structurally disjoint from win-back's audience: win-back requires a real last_used_at in the 30-90d band, which an org with zero usage can never have.