fix(api): hide sensitive fields by default

Add model-level hidden fields for secrets, tokens, keys, notification
credentials, deployment logs, and environment values. Allow explicit
read:sensitive API access to reveal gated private keys and deployment logs,
and cover the behavior with feature and unit tests.

app/Models/CloudProviderToken.php

@@ -11,6 +11,10 @@ class CloudProviderToken extends BaseModel
         'name',
     ];
 
+    protected $hidden = [
+        'token',
+    ];
+
     protected $casts = [
         'token' => 'encrypted',
     ];