Implement role-based access control and revert hardcoded OAuth credentials

- sms-admin: full access (create, edit, delete)
- sms-manager: create and edit only, no delete
- sms-viewer: read-only, all write buttons hidden
- Apply EnforcesRolesInRelation trait to BatchesRelationManager
- Revert Nextcloud OAuth credentials to env vars (OAUTH_CLOUDSPICESBLUE_*)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/Traits/EnforcesRoles.php

@@ -6,28 +6,23 @@ use Illuminate\Database\Eloquent\Model;
 
 trait EnforcesRoles
 {
-    private static function canWrite(): bool
+    public static function canCreate(): bool
     {
         return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false;
     }
 
-    public static function canCreate(): bool
-    {
-        return static::canWrite();
-    }
-
     public static function canEdit(Model $record): bool
     {
-        return static::canWrite();
+        return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false;
     }
 
     public static function canDelete(Model $record): bool
     {
-        return static::canWrite();
+        return auth()->user()?->hasRole('sms-admin') ?? false;
     }
 
     public static function canDeleteAny(): bool
     {
-        return static::canWrite();
+        return auth()->user()?->hasRole('sms-admin') ?? false;
     }
 }

app/Traits/EnforcesRolesInRelation.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Traits;
+
+trait EnforcesRolesInRelation
+{
+    public function canCreate(): bool
+    {
+        return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false;
+    }
+
+    public function canEdit(): bool
+    {
+        return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false;
+    }
+
+    public function canDelete(): bool
+    {
+        return auth()->user()?->hasRole('sms-admin') ?? false;
+    }
+
+    public function canDeleteAny(): bool
+    {
+        return auth()->user()?->hasRole('sms-admin') ?? false;
+    }
+}