Put App Secret

Declare a secret, or rotate where an existing one lives.

UPSERT, not create. Re-declaring a key is a rotation rather than a 409: the builder is saying the value moved, and refusing would make the common case an error and push them towards delete-then-create, which loses created_at and briefly leaves the app declaring nothing.

provider_ref is a POINTER. The DTO refuses the obvious credential shapes, which is a guardrail against the honest mistake rather than a security control: nothing can reliably tell a path from a secret, but someone pasting a value because the field sits next to the key is the likely error, and this turns a silent unrecoverable leak into a 422 they read.