refactor(auth): enforce team member authorization across app

Restrict sensitive operations to admins/owners and hide sensitive data
from team members:
- Add authorization checks to Livewire components and API endpoints
- Restrict team members from accessing sensitive permissions and data
- Hide environment variable values from non-admin team members
- Update policies to enforce team-level admin status requirement
- Add useSensitivePermissions policy for read:sensitive tokens
- Improve disabled button UX with auth-specific tooltips
- Add authorization checks in middleware for API tokens

Closes authorization gaps in project management, server management,
and settings components.

app/Livewire/Project/Application/DeploymentNavbar.php

@@ -6,11 +6,14 @@ use App\Enums\ApplicationDeploymentStatus;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\Server;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Carbon;
 use Livewire\Component;
 
 class DeploymentNavbar extends Component
 {
+    use AuthorizesRequests;
+
     public ApplicationDeploymentQueue $application_deployment_queue;
 
     public Application $application;
@@ -35,10 +38,15 @@ class DeploymentNavbar extends Component
 
     public function show_debug()
     {
-        $this->application->settings->is_debug_enabled = ! $this->application->settings->is_debug_enabled;
-        $this->application->settings->save();
-        $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
-        $this->dispatch('refreshQueue');
+        try {
+            $this->authorize('update', $this->application);
+            $this->application->settings->is_debug_enabled = ! $this->application->settings->is_debug_enabled;
+            $this->application->settings->save();
+            $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
+            $this->dispatch('refreshQueue');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function force_start()