fix: return 404 for update feeds when update server is disabled (#589)

The RepoAssignmentPublicFeed middleware did not check LicensingEnabled,
so feed endpoints responded with valid data even when the feature was
disabled. Now checks the effective config (repo → org cascade) and
returns 404 when neither level has LicensingEnabled=true.

Co-Authored-By: Moko Consulting <hello@mokoconsulting.tech>

services/context/repo_public_feed.go

@@ -42,11 +42,16 @@ func RepoAssignmentPublicFeed() func(ctx *Context) {
 		repo.Owner = owner
 		ctx.Repo.Repository = repo
 
-		// Load update config for platform-aware routing.
-		repoUpdateCfg, _ := updateserver_model.GetRepoConfig(ctx, repo.ID)
-		if repoUpdateCfg != nil {
-			ctx.Data["RepoUpdatePlatform"] = repoUpdateCfg.Platform
-		} else {
+		// Check if the update server is enabled (repo config → org config).
+		// Return 404 when neither level has LicensingEnabled=true.
+		cfg := updateserver_model.GetEffectiveConfig(ctx, owner.ID, repo.ID)
+		if cfg == nil || !cfg.LicensingEnabled {
+			ctx.NotFound(nil)
+			return
+		}
+
+		ctx.Data["RepoUpdatePlatform"] = cfg.Platform
+		if cfg.Platform == "" {
 			ctx.Data["RepoUpdatePlatform"] = "joomla"
 		}