refactor(auth): enforce team member authorization across app

Restrict sensitive operations to admins/owners and hide sensitive data
from team members:
- Add authorization checks to Livewire components and API endpoints
- Restrict team members from accessing sensitive permissions and data
- Hide environment variable values from non-admin team members
- Update policies to enforce team-level admin status requirement
- Add useSensitivePermissions policy for read:sensitive tokens
- Improve disabled button UX with auth-specific tooltips
- Add authorization checks in middleware for API tokens

Closes authorization gaps in project management, server management,
and settings components.

app/Livewire/Project/Shared/EnvironmentVariable/All.php

@@ -72,7 +72,7 @@ class All extends Component
             $query->orderBy('order');
         }
 
-        return $query->get();
+        return $this->nullLockedValues($query->get());
     }
 
     public function getEnvironmentVariablesPreviewProperty()
@@ -86,7 +86,21 @@ class All extends Component
             $query->orderBy('order');
         }
 
-        return $query->get();
+        return $this->nullLockedValues($query->get());
+    }
+
+    private function nullLockedValues($envs)
+    {
+        $isMember = auth()->user()?->isMember();
+
+        $envs->each(function ($env) use ($isMember) {
+            if ($env->is_shown_once || $isMember) {
+                $env->value = null;
+                $env->real_value = null;
+            }
+        });
+
+        return $envs;
     }
 
     public function getDevView()
@@ -99,7 +113,12 @@ class All extends Component
 
     private function formatEnvironmentVariables($variables)
     {
-        return $variables->map(function ($item) {
+        $isMember = auth()->user()?->isMember();
+
+        return $variables->map(function ($item) use ($isMember) {
+            if ($isMember) {
+                return "$item->key=(Hidden, only admins can view)";
+            }
             if ($item->is_shown_once) {
                 return "$item->key=(Locked Secret, delete and add again to change)";
             }