restore: bring back f8a1310 (security review) state

Restores all files to the f8a1310 security-review snapshot as requested,
plus the 2 boot-critical fixes from a24c8a2 (config/session.php env()
instead of app()->environment(), and removal of the duplicate $activeTab
in ProjectMap.php) so the application actually boots.

Forward commit, no history rewrite. The 7d854ff state remains in history.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/Http/Controllers/Reports/ExportController.php

@@ -11,21 +11,25 @@ use App\Exports\ProjectsExport;
 use App\Exports\PhasesExport;
 use App\Exports\InspectionsExport;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Gate;
 
 class ExportController extends Controller
 {
     public function exportProjects(Request $request)
     {
+        Gate::authorize('manage all');
         return Excel::download(new ProjectsExport, 'projects.xlsx');
     }
 
     public function exportPhases(Request $request)
     {
+        Gate::authorize('manage all');
         return Excel::download(new PhasesExport, 'phases.xlsx');
     }
 
     public function exportInspections(Request $request)
     {
+        Gate::authorize('manage all');
         return Excel::download(new InspectionsExport, 'inspections.xlsx');
     }
 }