fix: critical privilege escalation in team invitation system

This commit addresses a critical security vulnerability where low-privileged
users (members) could invite high-privileged users (admins/owners) to teams,
allowing them to escalate their own privileges through password reset.

Root Causes Fixed:
1. TeamPolicy authorization checks were commented out, allowing all team
   members to manage invitations instead of just admins/owners
2. Missing role elevation checks in InviteLink component allowed members
   to invite users with higher privileges

Security Fixes:

1. app/Policies/TeamPolicy.php
   - Uncommented and enforced authorization checks for:
     * update() - Only admins/owners can update team settings
     * delete() - Only admins/owners can delete teams
     * manageMembers() - Only admins/owners can manage team members
     * viewAdmin() - Only admins/owners can view admin panel
     * manageInvitations() - Only admins/owners can manage invitations

2. app/Livewire/Team/InviteLink.php
   - Added explicit role elevation checks to prevent:
     * Members from inviting admins or owners
     * Admins from inviting owners (defense-in-depth)
   - Validates that inviter has sufficient privileges for target role

Test Coverage:

1. tests/Feature/TeamPolicyTest.php
   - 24 comprehensive tests covering all policy methods
   - Tests for owner, admin, member, and non-member access
   - Specific tests for the privilege escalation vulnerability

2. tests/Feature/TeamInvitationPrivilegeEscalationTest.php
   - 11 tests covering all role elevation scenarios
   - Tests member → admin/owner escalation (blocked)
   - Tests admin → owner escalation (blocked)
   - Tests valid invitation paths for each role

Impact:
- Prevents privilege escalation attacks
- Protects all Coolify instances from unauthorized access
- Enforces proper role hierarchy in team management

References:
- Identified by Aikido AI whitebox pentest service
- CVE: Pending assignment
- Severity: Critical

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

app/Policies/TeamPolicy.php

@@ -42,8 +42,7 @@ class TeamPolicy
             return false;
         }
 
-        // return $user->isAdmin() || $user->isOwner();
-        return true;
+        return $user->isAdmin() || $user->isOwner();
     }
 
     /**
@@ -56,8 +55,7 @@ class TeamPolicy
             return false;
         }
 
-        // return $user->isAdmin() || $user->isOwner();
-        return true;
+        return $user->isAdmin() || $user->isOwner();
     }
 
     /**
@@ -70,8 +68,7 @@ class TeamPolicy
             return false;
         }
 
-        // return $user->isAdmin() || $user->isOwner();
-        return true;
+        return $user->isAdmin() || $user->isOwner();
     }
 
     /**
@@ -84,8 +81,7 @@ class TeamPolicy
             return false;
         }
 
-        //  return $user->isAdmin() || $user->isOwner();
-        return true;
+        return $user->isAdmin() || $user->isOwner();
     }
 
     /**
@@ -98,7 +94,6 @@ class TeamPolicy
             return false;
         }
 
-        // return $user->isAdmin() || $user->isOwner();
-        return true;
+        return $user->isAdmin() || $user->isOwner();
     }
 }