Set and manage environment variables and secrets for a Deno Deploy app (contexts model)

Documented steps

1. Auth: CLI: keyring token from deno deploy login. API: Authorization: Bearer <token>, PATCH app or layer resources on https://api.deno.com.
2. Dashboard: app settings -> Environment Variables (or org settings for org-wide variables). Add name/value, toggle secret, and pick contexts (Production, Development, Build), then save.
3. Bulk import: paste a .env file's contents into the import box and click Import variables.
4. CLI: deno deploy env list | deno deploy env add KEY "value" [--secret] | deno deploy env update-value KEY "new" | deno deploy env update-contexts | deno deploy env delete KEY | deno deploy env load .env.
5. API: PATCH https://api.deno.com/v2/apps/{appId} (env_vars deep-merged by key); org-wide via PATCH https://api.deno.com/v2/layers/{layerId}; set secret:true to mask values in future responses; contexts is "all" or an explicit array.
6. Build-context vars apply only during builds; redeploy/next build pickup is generally required for new variables to take effect.
7. Official docs: https://docs.deno.com/deploy/reference/env_vars_and_contexts/ ; https://docs.deno.com/runtime/reference/cli/deploy/