Set an org secret by key

Path-keyed companion to POST /org/secrets. Idempotent: returns 201 the first time the key is set, 200 on subsequent updates. Same validation and write-only guarantees as POST.