FIX: skip_validations: true lets moderated users bypass posting restrictions in PM creation (#37862)

Silenced (and suspended) users in the discover allowed group could
bypass posting restrictions and create PM topics via the
`continue_convo` endpoint because `PostCreator.create!` was called with
`skip_validations: true`.

This is defended against in depth anyway, so this is just extra
hardening, all that would happen is that they would accumulate another
topic they can not interact with.

plugins/discourse-ai/app/controllers/discourse_ai/discover/discoveries_controller.rb

@@ -74,6 +74,8 @@ module DiscourseAi
              !current_user.in_any_groups?(ai_discover_persona.allowed_group_ids.to_a)
           raise Discourse::InvalidAccess.new
         end
+
+        raise Discourse::InvalidAccess if guardian.is_silenced?
       end
     end
   end

plugins/discourse-ai/spec/requests/discover/discoveries_controller_spec.rb

@@ -82,6 +82,26 @@ RSpec.describe DiscourseAi::Discover::DiscoveriesController do
         expect(response.parsed_body["errors"]).to include("context")
       end
 
+      it "does not allow suspended users to create conversations" do
+        user.update!(suspended_till: 1.year.from_now, suspended_at: Time.zone.now)
+
+        expect {
+          post "/discourse-ai/discoveries/continue-convo", params: { query:, context: }
+        }.not_to change { Topic.count }
+
+        expect(response.status).to eq(403)
+      end
+
+      it "does not allow silenced users to create conversations" do
+        user.update!(silenced_till: 1.year.from_now)
+
+        expect {
+          post "/discourse-ai/discoveries/continue-convo", params: { query:, context: }
+        }.not_to change { Topic.count }
+
+        expect(response.status).to eq(403)
+      end
+
       describe "group-based restrictions" do
         fab!(:staff_group) { Group[:staff] }