fix(api): hide sensitive fields by default

Add model-level hidden fields for secrets, tokens, keys, notification
credentials, deployment logs, and environment values. Allow explicit
read:sensitive API access to reveal gated private keys and deployment logs,
and cover the behavior with feature and unit tests.

app/Models/SharedEnvironmentVariable.php

@@ -30,6 +30,10 @@ class SharedEnvironmentVariable extends Model
         'version',
     ];
 
+    protected $hidden = [
+        'value',
+    ];
+
     protected $casts = [
         'key' => 'string',
         'value' => 'encrypted',