refactor(auth): enforce team member authorization across app

Restrict sensitive operations to admins/owners and hide sensitive data
from team members:
- Add authorization checks to Livewire components and API endpoints
- Restrict team members from accessing sensitive permissions and data
- Hide environment variable values from non-admin team members
- Update policies to enforce team-level admin status requirement
- Add useSensitivePermissions policy for read:sensitive tokens
- Improve disabled button UX with auth-specific tooltips
- Add authorization checks in middleware for API tokens

Closes authorization gaps in project management, server management,
and settings components.

app/Http/Controllers/Api/ApplicationsController.php

@@ -54,6 +54,10 @@ class ApplicationsController extends Controller
             ]);
         }
 
+        if ($application->is_shown_once ?? false) {
+            $application->makeHidden(['value', 'real_value']);
+        }
+
         return serializeApiResponse($application);
     }
 

app/Http/Controllers/Api/ServicesController.php

@@ -35,6 +35,10 @@ class ServicesController extends Controller
             ]);
         }
 
+        if ($service->is_shown_once ?? false) {
+            $service->makeHidden(['value', 'real_value']);
+        }
+
         return serializeApiResponse($service);
     }
 

app/Http/Middleware/ApiAbility.php

@@ -6,9 +6,34 @@ use Laravel\Sanctum\Http\Middleware\CheckForAnyAbility;
 
 class ApiAbility extends CheckForAnyAbility
 {
+    /**
+     * Permissions that only admins/owners may use.
+     */
+    private const MEMBER_DISALLOWED_ABILITIES = [
+        'root',
+        'write',
+        'write:sensitive',
+        'deploy',
+        'read:sensitive',
+    ];
+
     public function handle($request, $next, ...$abilities)
     {
         try {
+            $token = $request->user()->currentAccessToken();
+            $teamId = (int) data_get($token, 'team_id');
+
+            if ($teamId && ! $request->user()->isAdminOfTeam($teamId)) {
+                $tokenAbilities = $token->abilities ?? [];
+                $disallowed = array_intersect($tokenAbilities, self::MEMBER_DISALLOWED_ABILITIES);
+
+                if (! empty($disallowed)) {
+                    return response()->json([
+                        'message' => 'This API token has permissions ('.implode(', ', $disallowed).') that exceed your current role as a team member. Members are restricted to read-only API access. Please revoke this token and create a new one with only read permissions.',
+                    ], 403);
+                }
+            }
+
             if ($request->user()->tokenCan('root')) {
                 return $next($request);
             }

app/Http/Middleware/ApiSensitiveData.php

@@ -10,10 +10,13 @@ class ApiSensitiveData
     public function handle(Request $request, Closure $next)
     {
         $token = $request->user()->currentAccessToken();
+        $hasTokenPermission = $token->can('root') || $token->can('read:sensitive');
+        $teamId = (int) data_get($token, 'team_id');
+        $isAdmin = $teamId ? $request->user()->isAdminOfTeam($teamId) : false;
 
-        // Allow access to sensitive data if token has root or read:sensitive permission
+        // Allow access to sensitive data only if token has permission AND user is admin/owner
         $request->attributes->add([
-            'can_read_sensitive' => $token->can('root') || $token->can('read:sensitive'),
+            'can_read_sensitive' => $hasTokenPermission && $isAdmin,
         ]);
 
         return $next($request);