Enforce user_invites setting when creating invites

handleCreateUserInvite only checked whether the user was silenced, so
any logged-in user could create invite codes via POST /api/me/invites
even when user_invites was set to "admin" or disabled, bypassing closed
registration. Apply the same canUserInvite check used by the invites
page.

Fixes GHSA-ffqf-jw28-cwvp

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>