Set a secret by key

Path-keyed companion to POST /functions/{id}/secrets. Idempotent: returns 201 the first time the key is set, 200 on subsequent updates. Same validation rules and same write-only guarantees as the POST verb; the new value lands in the running handler on the next deploy.