fix(api): expose sensitive fields for privileged tokens

Privileged API tokens can read hidden resource fields in environment and
resource responses, including instance-admin team tokens with team_id 0.

Configuration hashes now include hidden environment variable values so
secret edits trigger restart detection.

app/Http/Controllers/Api/ProjectController.php

@@ -166,6 +166,9 @@ class ProjectController extends Controller
             return response()->json(['message' => 'Environment not found.'], 404);
         }
         $environment = $environment->load(['applications', 'postgresqls', 'redis', 'mongodbs', 'mysqls', 'mariadbs', 'services']);
+        collect(['applications', 'postgresqls', 'redis', 'mongodbs', 'mysqls', 'mariadbs', 'services'])
+            ->flatMap(fn (string $relation) => $environment->{$relation})
+            ->each(fn ($resource) => exposeSensitiveFields($resource));
 
         return response()->json(serializeApiResponse($environment));
     }