refactor(auth): enforce team member authorization across app

Restrict sensitive operations to admins/owners and hide sensitive data
from team members:
- Add authorization checks to Livewire components and API endpoints
- Restrict team members from accessing sensitive permissions and data
- Hide environment variable values from non-admin team members
- Update policies to enforce team-level admin status requirement
- Add useSensitivePermissions policy for read:sensitive tokens
- Improve disabled button UX with auth-specific tooltips
- Add authorization checks in middleware for API tokens

Closes authorization gaps in project management, server management,
and settings components.

app/Livewire/SettingsEmail.php

@@ -5,6 +5,7 @@ namespace App\Livewire;
 use App\Models\InstanceSettings;
 use App\Models\Team;
 use App\Notifications\TransactionalEmails\Test;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\RateLimiter;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
@@ -12,6 +13,8 @@ use Livewire\Component;
 
 class SettingsEmail extends Component
 {
+    use AuthorizesRequests;
+
     public InstanceSettings $settings;
 
     #[Locked]
@@ -103,6 +106,7 @@ class SettingsEmail extends Component
     public function submit()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->resetErrorBag();
             $this->syncData(true);
             $this->dispatch('success', 'Transactional email settings updated.');
@@ -114,6 +118,7 @@ class SettingsEmail extends Component
     public function instantSave(string $type)
     {
         try {
+            $this->authorize('update', $this->settings);
             $currentSmtpEnabled = $this->settings->smtp_enabled;
             $currentResendEnabled = $this->settings->resend_enabled;
             $this->resetErrorBag();
@@ -141,6 +146,7 @@ class SettingsEmail extends Component
     public function submitSmtp()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->validate([
                 'smtpEnabled' => 'boolean',
                 'smtpFromAddress' => 'required|email',
@@ -184,6 +190,7 @@ class SettingsEmail extends Component
     public function submitResend()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->validate([
                 'resendEnabled' => 'boolean',
                 'resendApiKey' => 'required|string',
@@ -214,6 +221,7 @@ class SettingsEmail extends Component
     public function sendTestEmail()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->validate([
                 'testEmailAddress' => 'required|email',
             ], [