AMPLIFY_DEPLOY: document Gen 2 Environment variables vs Secrets split

Amplify Gen 2's console has two separate pages for runtime config:
Environment variables (plaintext) and Secrets (SSM Parameter Store
SecureString). The earlier 'mark as Secret with eye icon' wording was
Gen 1; in Gen 2 you choose by which page you add the value on.

Step 2 rewritten:
- Brief explanation of both pages and how they're injected (both end
  up as plain env vars in the app, same name).
- Combined variable table with a Page column showing where each value
  lives.
- Rule-of-thumb: anything that would let someone impersonate the app
  to CiviCRM or bypass a gate is a Secret; hostnames/usernames are
  fine in Environment variables.
- Callout reminding not to duplicate names across both pages
  (precedence undefined in Gen 2).

AMPLIFY_DEPLOY.md

@@ -32,36 +32,46 @@ through managed Lambda behind a CloudFront CDN. The `amplify.yml` and
 6. Amplify reads `amplify.yml` automatically; you do not need to edit
    the build spec on this screen. Click **Next**.
 
-## Step 2 — Environment variables
+## Step 2 — Environment variables and Secrets
 
-On the environment-variables screen, add the following. Required ones first:
+Amplify Gen 2 splits configuration across **two separate pages** in the
+console sidebar (under **Hosting**):
 
-| Variable | Value |
+- **Environment variables** — plaintext-at-rest, intended for non-sensitive
-|---|---|
+  config. Readable by anyone with `amplify:GetApp` permission on the AWS
-| `CIVI_BASE_URL` | e.g. `https://crm.fci.coop` |
+  account.
-| `CIVI_API_KEY` | mark as **Secret** (eye icon on the value field) |
+- **Secrets** — values stored in AWS Systems Manager Parameter Store as
-| `CIVI_SITE_KEY` | mark as **Secret** |
+  SecureString, encrypted at rest. Injected into the build/runtime as
+  normal environment variables under the same name, so application code
+  doesn't need to know the difference.
 
-Do **not** set `NODE_ENV=production` in the Amplify panel. Amplify and Next
+Add each variable to the page indicated below:
-already set it correctly at runtime; setting it at build time causes
-`npm ci` to skip devDependencies, which breaks the Tailwind/PostCSS step.
-The `amplify.yml` in this repo guards against this with `--include=dev`,
-but it's cleaner not to set it at all.
 
-Optional, only if relevant:
+| Variable | Page | Notes |
+|---|---|---|
+| `CIVI_BASE_URL` | Environment variables | e.g. `https://crm.fci.coop` |
+| `CIVI_API_KEY` | **Secrets** | Required |
+| `CIVI_SITE_KEY` | **Secrets** | Required |
+| `CIVI_HTTP_AUTH_USER` | Environment variables | Only if CiviCRM has webserver-level Basic Auth in front of it |
+| `CIVI_HTTP_AUTH_PASS` | **Secrets** | Only if above set |
+| `HEALTH_TOKEN` | **Secrets** | Optional; gates `/api/health` in production |
+| `PREVIEW_ADMIN_TOKEN` | **Secrets** | Optional; gates `/api/preview-link` |
 
-| Variable | When |
+Rule of thumb: if leaking the value would let someone impersonate the app
-|---|---|
+to CiviCRM, or bypass a gate, it goes in **Secrets**. Hostnames and
-| `CIVI_HTTP_AUTH_USER` | CiviCRM has webserver-level Basic Auth in front of it |
+usernames are fine in plaintext Environment variables.
-| `CIVI_HTTP_AUTH_PASS` | same — mark **Secret** |
-| `HEALTH_TOKEN` | gates `/api/health` in production — mark **Secret** |
-| `PREVIEW_ADMIN_TOKEN` | gates `/api/preview-link` — mark **Secret** |
 
-"Secret" values are encrypted at rest in AWS Systems Manager Parameter
+> **Don't set `NODE_ENV=production` in either page.** Amplify and Next
-Store and only injected into the build/runtime environment. They are not
+> already set it correctly at runtime; setting it at build time causes
-visible in logs or to anyone without `amplify:*` IAM permissions.
+> `npm ci` to skip devDependencies, which breaks the Tailwind/PostCSS
+> step. The `amplify.yml` in this repo guards against this with
+> `--include=dev`, but it's cleaner not to set it at all.
 
-Click **Next**, review, **Save and deploy**.
+> **Don't duplicate names across both pages.** If the same variable
+> name appears in both Environment variables and Secrets, Amplify's
+> precedence is undefined in Gen 2.
+
+Click through, review, **Save and deploy**.
 
 ## Step 3 — First build