fix(api): expose sensitive fields for privileged tokens

Privileged API tokens can read hidden resource fields in environment and
resource responses, including instance-admin team tokens with team_id 0.

Configuration hashes now include hidden environment variable values so
secret edits trigger restart detection.

app/Http/Controllers/Api/ProjectController.php

@@ -166,6 +166,9 @@ class ProjectController extends Controller
             return response()->json(['message' => 'Environment not found.'], 404);
         }
         $environment = $environment->load(['applications', 'postgresqls', 'redis', 'mongodbs', 'mysqls', 'mariadbs', 'services']);
+        collect(['applications', 'postgresqls', 'redis', 'mongodbs', 'mysqls', 'mariadbs', 'services'])
+            ->flatMap(fn (string $relation) => $environment->{$relation})
+            ->each(fn ($resource) => exposeSensitiveFields($resource));
 
         return response()->json(serializeApiResponse($environment));
     }

app/Http/Controllers/Api/ResourcesController.php

@@ -56,6 +56,7 @@ class ResourcesController extends Controller
         }
         $resources = $resources->flatten();
         $resources = $resources->map(function ($resource) {
+            exposeSensitiveFields($resource);
             $payload = $resource->toArray();
             $payload['status'] = $resource->status;
             $payload['type'] = $resource->type();

app/Http/Middleware/ApiSensitiveData.php

@@ -11,8 +11,9 @@ class ApiSensitiveData
     {
         $token = $request->user()->currentAccessToken();
         $hasTokenPermission = $token->can('root') || $token->can('read:sensitive');
-        $teamId = (int) data_get($token, 'team_id');
-        $isAdmin = $teamId ? $request->user()->isAdminOfTeam($teamId) : false;
+        $teamId = data_get($token, 'team_id');
+        // team_id 0 is the instance-admin team, so a falsy check must not exclude it
+        $isAdmin = ! is_null($teamId) ? $request->user()->isAdminOfTeam((int) $teamId) : false;
 
         // Allow access to sensitive data only if token has permission AND user is admin/owner
         $request->attributes->add([