Implement role-based access control and revert hardcoded OAuth credentials

- sms-admin: full access (create, edit, delete)
- sms-manager: create and edit only, no delete
- sms-viewer: read-only, all write buttons hidden
- Apply EnforcesRolesInRelation trait to BatchesRelationManager
- Revert Nextcloud OAuth credentials to env vars (OAUTH_CLOUDSPICESBLUE_*)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/Filament/User/Resources/ProductResource/RelationManagers/BatchesRelationManager.php

@@ -6,6 +6,7 @@ use App\Models\Farmer;
 use App\Models\ProductSize;
 use App\Models\Recipe;
 use App\Models\Spice;
+use App\Traits\EnforcesRolesInRelation;
 use Filament\Forms;
 use Filament\Forms\Form;
 use Filament\Forms\Get;
@@ -16,6 +17,7 @@ use Illuminate\Support\HtmlString;
 
 class BatchesRelationManager extends RelationManager
 {
+    use EnforcesRolesInRelation;
     protected static string $relationship = 'batches';
     protected static ?string $title = 'Chargen (LOT)';
     protected static ?string $modelLabel = 'Charge';