Implement role-based access control and revert hardcoded OAuth credentials

- sms-admin: full access (create, edit, delete)
- sms-manager: create and edit only, no delete
- sms-viewer: read-only, all write buttons hidden
- Apply EnforcesRolesInRelation trait to BatchesRelationManager
- Revert Nextcloud OAuth credentials to env vars (OAUTH_CLOUDSPICESBLUE_*)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

config/services.php

@@ -36,9 +36,9 @@ return [
     ],
 
     'nextcloud' => [
-        'client_id'     => 'IxZ1RQgoRxlgKcplVHFWDYhFFlOieX34X3ceSvb0KkkZJ5xKxTZ6Rxozs5rwZR7h',
-        'client_secret' => 'gSdG1hJSTqHq6jaVLWbINB22ZfNZZsMmufCloZ3jcgWaoBIJSNEeqm0yhe3jyxnu',
-        'redirect'      => 'https://sms.spices.blue/auth/nextcloud/callback',
+        'client_id'     => env('OAUTH_CLOUDSPICESBLUE_ID'),
+        'client_secret' => env('OAUTH_CLOUDSPICESBLUE_SECRETKEY'),
+        'redirect'      => env('OAUTH_CLOUDSPICESBLUE_REDIRECTURI', 'https://sms.spices.blue/auth/nextcloud/callback'),
         'instance_uri'  => 'https://cloud.spices.blue',
     ],