refactor(auth): enforce member authorization and hide sensitive data

[andrasbacsai]

Summary

• Restrict team members from accessing owner/admin-only API permissions (root, write, deploy, read:sensitive)
• Hide environment variable values from team members in API responses
• Add authorization checks to all API endpoints touching teams, servers, projects, environments, and security resources
• Wrap Livewire action methods with authorization checks and unified error handling
• Update API middleware to enforce role-based access control for sensitive operations
• Add comprehensive browser and unit tests for member authorization scenarios

Breaking Changes

Team members with existing API tokens containing owner-level permissions (root, write, deploy, read:sensitive) will no longer be able to use those permissions. Tokens with restricted abilities should be revoked and recreated with read-only permissions.

Key Changes

API Authorization:

• ApiAbility middleware now validates that members cannot use owner-only abilities
• ApiSensitiveData middleware restricts sensitive data access based on user role
• Added explicit authorization checks before resource mutations across all controllers

Livewire Authorization:

• All action methods wrapped in try-catch with shared handleError() handler
• Added authorization checks to deployment, backup, deletion, and configuration methods
• Improved error handling for authorization failures in components

Data Filtering:

• Environment variable values hidden from team members in Application/Service API responses
• Only owners and admins can read sensitive environment variable values

Documentation:

• Added browser test best practices and Livewire mount() error handling guidance to CLAUDE.md
• Documented Docker worktree setup, policy test patterns, and browser test conventions in .ai/lessons.md

---

Related to #8628