Upsert secrets.

Returns only the secrets this call wrote, names and timestamps only — values are write-only. Refused for session tokens (held by potentially-untrusted code running inside a session); mutations require an API key or user token.