feat(privacy): enforce avatar/presence visibility and invite restrictions

app/users/repository.py

@@ -140,6 +140,16 @@ async def get_contact_relation(db: AsyncSession, *, user_id: int, contact_user_i
     return result.scalar_one_or_none()
 
 
+async def is_user_in_contacts(db: AsyncSession, *, owner_user_id: int, candidate_user_id: int) -> bool:
+    result = await db.execute(
+        select(UserContact.id).where(
+            UserContact.user_id == owner_user_id,
+            UserContact.contact_user_id == candidate_user_id,
+        ).limit(1)
+    )
+    return result.scalar_one_or_none() is not None
+
+
 async def list_contacts(db: AsyncSession, *, user_id: int) -> list[User]:
     stmt = (
         select(User)