refactor(auth): enforce team member authorization across app

Restrict sensitive operations to admins/owners and hide sensitive data
from team members:
- Add authorization checks to Livewire components and API endpoints
- Restrict team members from accessing sensitive permissions and data
- Hide environment variable values from non-admin team members
- Update policies to enforce team-level admin status requirement
- Add useSensitivePermissions policy for read:sensitive tokens
- Improve disabled button UX with auth-specific tooltips
- Add authorization checks in middleware for API tokens

Closes authorization gaps in project management, server management,
and settings components.

app/Livewire/Boarding/Index.php

@@ -8,12 +8,15 @@ use App\Models\Project;
 use App\Models\Server;
 use App\Models\Team;
 use App\Services\ConfigurationRepository;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
 use Visus\Cuid2\Cuid2;
 
 class Index extends Component
 {
+    use AuthorizesRequests;
+
     protected $listeners = [
         'refreshBoardingIndex' => 'validateServer',
         'prerequisitesInstalled' => 'handlePrerequisitesInstalled',
@@ -172,6 +175,9 @@ class Index extends Component
 
     public function skipBoarding()
     {
+        if (auth()->user()?->isMember()) {
+            return redirect()->route('dashboard');
+        }
         Team::find(currentTeam()->id)->update([
             'show_boarding' => false,
         ]);
@@ -257,6 +263,7 @@ class Index extends Component
         ]);
 
         try {
+            $this->authorize('create', PrivateKey::class);
             $privateKey = PrivateKey::createAndStore([
                 'name' => $this->privateKeyName,
                 'description' => $this->privateKeyDescription,
@@ -280,6 +287,12 @@ class Index extends Component
             'remoteServerUser' => 'required|string',
         ]);
 
+        try {
+            $this->authorize('create', Server::class);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+
         $this->privateKey = formatPrivateKey($this->privateKey);
         $foundServer = Server::whereIp($this->remoteServerHost)->first();
         if ($foundServer) {