fix(api): hide sensitive fields by default

Add model-level hidden fields for secrets, tokens, keys, notification
credentials, deployment logs, and environment values. Allow explicit
read:sensitive API access to reveal gated private keys and deployment logs,
and cover the behavior with feature and unit tests.

app/Models/S3Storage.php

@@ -26,6 +26,11 @@ class S3Storage extends BaseModel
         'unusable_email_sent',
     ];
 
+    protected $hidden = [
+        'key',
+        'secret',
+    ];
+
     protected $casts = [
         'is_usable' => 'boolean',
         'key' => 'encrypted',