Postfix: Port 587 activated by uncommenting a line in master.cf. I see no reference to this at postfix.org. Where is this officially documented?

This is officially documented in Managing multiple Postfix instances on a single host, but although it's very common, it's described as a single case among many possibilities (emphasis is mine):

Why multiple Postfix instances

Postfix is a general-purpose mail system that can be configured to serve a variety of needs. Examples of Postfix applications are:

• Local mail submission for shell users and system processes.
• Incoming (MX host) email from the Internet.
• Outbound mail relay for a corporate network.
• Authenticated submission for roaming users.
• Before/after content-filter mail.

A single Postfix configuration can provide many or all of these services, but a complex interplay of settings may be required, for example with master.cf options overriding main.cf settings. In this document we take the view that multiple Postfix instances may be a simpler way to configure a multi-function Postfix system.

The Postfix Configuration Parameters page doesn't tell any of this because it's out of its scope: it just lists the possible parameters you can use in main.cf, but doesn't tell how to override them with master.cf.

Essentially, "uncommenting the line" and the -o (Override the named main.cf configuration parameter) arguments beneath it is about starting another instance of a Postfix component, smtpd with different settings:

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (no)    (never) (100)
# ==========================================================================
smtp      inet  n       -       y       -       -       smtpd

#submission inet n       -       y       -       -       smtpd
#  -o syslog_name=postfix/submission
#  -o smtpd_tls_security_level=encrypt
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=
#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING

The currently active line is another smtpd instance listening on smtp port 25 with the main.cf settings, whereas the line beginning with submission creates another instance listening on submission port 587. The settings specified with -o overrides the settings in main.cf, making it possible to add SASL authentication, mandatory encryption etc. that won't be required on normal SMTP between two MTAs (i.e. incoming mail).

In other words, the service describes the port and the command the Postfix component. You could even have a port number or ip:port there, instead:

# service type  private unpriv  chroot  wakeup  maxproc command + args
# ==========================================================================
587       inet  n       -       y       -       -       smtpd
127.0.0.1:10026 inet n  -       y       -       -       smtpd