fix(security): enforce team access on mutable actions

Authorize cloud provider token access, audit sensitive operations, and
standardize public IDs across deployment and resource flows.

app/Livewire/Server/CloudProviderToken/Show.php

@@ -5,6 +5,7 @@ namespace App\Livewire\Server\CloudProviderToken;
 use App\Models\CloudProviderToken;
 use App\Models\Server;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Http;
 use Livewire\Component;
 
 class Show extends Component
@@ -67,6 +68,16 @@ class Show extends Component
 
             $this->server->cloudProviderToken()->associate($ownedToken);
             $this->server->save();
+
+            auditLog('ui.server.cloud_token_assigned', [
+                'team_id' => currentTeam()->id,
+                'server_uuid' => $this->server->uuid,
+                'server_name' => $this->server->name,
+                'cloud_token_uuid' => $ownedToken->uuid,
+                'cloud_token_name' => $ownedToken->name,
+                'provider' => $ownedToken->provider,
+            ]);
+
             $this->dispatch('success', 'Hetzner token updated successfully.');
             $this->dispatch('refreshServerShow');
         } catch (\Exception $e) {
@@ -79,7 +90,7 @@ class Show extends Component
     {
         try {
             // First, validate the token itself
-            $response = \Illuminate\Support\Facades\Http::withHeaders([
+            $response = Http::withHeaders([
                 'Authorization' => 'Bearer '.$token->token,
             ])->timeout(10)->get('https://api.hetzner.cloud/v1/servers');
 
@@ -92,7 +103,7 @@ class Show extends Component
 
             // Check if this token can access the specific Hetzner server
             if ($this->server->hetzner_server_id) {
-                $serverResponse = \Illuminate\Support\Facades\Http::withHeaders([
+                $serverResponse = Http::withHeaders([
                     'Authorization' => 'Bearer '.$token->token,
                 ])->timeout(10)->get("https://api.hetzner.cloud/v1/servers/{$this->server->hetzner_server_id}");
 
@@ -123,7 +134,7 @@ class Show extends Component
                 return;
             }
 
-            $response = \Illuminate\Support\Facades\Http::withHeaders([
+            $response = Http::withHeaders([
                 'Authorization' => 'Bearer '.$token->token,
             ])->timeout(10)->get('https://api.hetzner.cloud/v1/servers');
 
@@ -132,6 +143,16 @@ class Show extends Component
             } else {
                 $this->dispatch('error', 'Hetzner token is invalid or has insufficient permissions.');
             }
+
+            auditLog('ui.server.cloud_token_validated', [
+                'team_id' => currentTeam()->id,
+                'server_uuid' => $this->server->uuid,
+                'server_name' => $this->server->name,
+                'cloud_token_uuid' => $token->uuid,
+                'cloud_token_name' => $token->name,
+                'provider' => $token->provider,
+                'valid' => $response->successful(),
+            ]);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }