fix(applications): allow admins to reveal client secret and copy without revealing

[BK1031]

• Allow Sentinel admins (in addition to the app owner) to reveal an application's client secret via GET /applications/:id/secret
• Make the client secret copy button fetch the secret from the server and copy it directly, so it no longer requires revealing first (safe while screensharing)
• Hide the reveal/copy buttons for users who aren't the owner or an admin, matching the backend gate