fix(api): hide sensitive fields by default

Add model-level hidden fields for secrets, tokens, keys, notification
credentials, deployment logs, and environment values. Allow explicit
read:sensitive API access to reveal gated private keys and deployment logs,
and cover the behavior with feature and unit tests.

app/Models/ApplicationDeploymentQueue.php

@@ -68,6 +68,10 @@ class ApplicationDeploymentQueue extends Model
         'finished_at',
     ];
 
+    protected $hidden = [
+        'logs',
+    ];
+
     protected $casts = [
         'pull_request_id' => 'integer',
         'finished_at' => 'datetime',