Optionaldefaultoperator: /cfx/secrets/<group>/<KEY>. stack: /cfx/stack/<stage>/<group>/<KEY>.
deploy: no SSM path; each function's deploy bakes its own value (logins, mode).
OptionalplainDefaults to false: the value is a secret, masked wherever it is shown.
OptionalrequiredDefaults to true. Optional only where the code works without the key.
One declared key. Every value is a string; an empty string is no value.