fix(api): hide nested server secrets from read tokens

Require read:sensitive for nested server logdrain and sentinel fields in
application and database API responses.

Limit deployment configuration column migration SQL to PostgreSQL.

app/Http/Controllers/Api/DatabasesController.php

@@ -51,11 +51,37 @@ class DatabasesController extends Controller
                 'mariadb_root_password',
             ]);
             $this->exposeNestedServerSecrets($database);
+        } else {
+            $this->hideNestedServerSecrets($database);
         }
 
         return serializeApiResponse($database);
     }
 
+    private function hideNestedServerSecrets(Model $model): void
+    {
+        $server = $model->destination?->server;
+        if ($server === null) {
+            return;
+        }
+
+        $server->makeHidden([
+            'logdrain_axiom_api_key',
+            'logdrain_newrelic_license_key',
+        ]);
+
+        if ($server->settings !== null) {
+            $server->settings->makeHidden([
+                'sentinel_token',
+                'sentinel_custom_url',
+                'logdrain_newrelic_license_key',
+                'logdrain_axiom_api_key',
+                'logdrain_custom_config',
+                'logdrain_custom_config_parser',
+            ]);
+        }
+    }
+
     /**
      * Expose sensitive fields on eager-loaded nested Server + ServerSetting
      * relations for callers with the `read:sensitive` or `root` token ability.