### Summary

Enabling the graceful drain endpoint without configuring a drain token makes `/health/drain` callable by any network-reachable client. A successful call starts process-wide shutdown and takes the worker out of rotation

### Current behavior

`health_drain()` intentionally does not use `user_api_key_auth` because Kubernetes `preStop` hooks commonly do not have proxy credentials

`_authorize_drain_request()` returns immediately when neither `general_settings.drain_endpoint_token` nor `DRAIN_ENDPOINT_TOKEN` is set:

~~~python expected = _drain_endpoint_token() if expected is None: return ~~~

The endpoint is therefore protected only by `enable_drain_endpoint`

### Reproduction

Enable the endpoint and omit the token:

~~~yaml general_settings: enable_drain_endpoint: true # drain_endpoint_token is omitted ~~~

Then call it without credentials:

~~~bash curl -i http://localhost:4000/health/drain ~~~

The request reaches `GracefulShutdownManager.start_shutdown()`, waits for the worker to drain, and causes readiness to fail until the process restarts. The endpoint is expected to be a `GET` route and may hold the client connection while draining

### Impact

Any caller…