test(privacy): enforce nobody group-invite policy

tests/test_chat_message_flow.py

@@ -559,6 +559,36 @@ async def test_group_invite_privacy_contacts_only(client, db_session):
     assert create_group_allowed.status_code == 200
 
 
+async def test_group_invite_privacy_nobody_blocks_invites_even_from_contacts(client, db_session):
+    inviter = await _create_verified_user(client, db_session, "invite_nobody_u1@example.com", "invite_nobody_u1", "strongpass123")
+    target = await _create_verified_user(client, db_session, "invite_nobody_u2@example.com", "invite_nobody_u2", "strongpass123")
+
+    me_inviter = await client.get("/api/v1/auth/me", headers={"Authorization": f"Bearer {inviter['access_token']}"})
+    me_target = await client.get("/api/v1/auth/me", headers={"Authorization": f"Bearer {target['access_token']}"})
+    inviter_id = me_inviter.json()["id"]
+    target_id = me_target.json()["id"]
+
+    set_nobody = await client.put(
+        "/api/v1/users/profile",
+        headers={"Authorization": f"Bearer {target['access_token']}"},
+        json={"privacy_group_invites": "nobody"},
+    )
+    assert set_nobody.status_code == 200
+
+    add_contact = await client.post(
+        f"/api/v1/users/{inviter_id}/contacts",
+        headers={"Authorization": f"Bearer {target['access_token']}"},
+    )
+    assert add_contact.status_code == 204
+
+    create_group_blocked = await client.post(
+        "/api/v1/chats",
+        headers={"Authorization": f"Bearer {inviter['access_token']}"},
+        json={"type": ChatType.GROUP.value, "title": "Nobody blocked group", "member_ids": [target_id]},
+    )
+    assert create_group_blocked.status_code == 403
+
+
 async def test_avatar_privacy_hidden_from_other_users_search(client, db_session):
     owner = await _create_verified_user(client, db_session, "avatar_owner@example.com", "avatar_owner", "strongpass123")
     viewer = await _create_verified_user(client, db_session, "avatar_viewer@example.com", "avatar_viewer", "strongpass123")