INTERNAL DEV - Embedded Relay Secrets Manager

Embedded Relay - Secrets Manager Convention (Internal)Secret name: {tenant}_salesforce_embedded_creds (e.g. alpha4_salesforce_embedded_creds) - one per tenant, since each client org gets its own unique Consumer Key/Secret (ECA/Connected App is never packaged/shared across tenants).
Where it's used: getSalesforceCredentials() in roadmap-node/src/api/services/salesforce/salesforce-signed-request.ts, called from consume-signed-request to HMAC-verify the incoming signed_request.
Required JSON shape:
{
  "secret": "<Consumer Secret from the client's ECA/Connected App>"
}
secret is the only field the code actually reads (creds.secret, used in validateSignedRequest). A key field (Consumer Key) can be stored alongside for reference/rotation purposes, but nothing currently consumes it.
How to set it: plain JSON secret, so it goes directly into the AWS Secrets Manager Console UI - no script needed.
Cache note: getSalesforceCredentials() caches in-memory for 5 minutes (roadmap-node's cachedCredentials). A secret update won't take effect until that cache expires or the process restarts.