fix: Align create and index to both return 404 for non-member rooms

Both create and index now return HTTP 404 Not Found when a bot tries to
access a room it's not a member of. This is consistent with REST API
security best practices (not revealing resource existence) and ensures
read and write permissions are handled identically.

Changed create action to no longer call super (which rendered HTML) and
instead directly handle the request with proper JSON API error responses.

Added test to verify create returns 404 for non-member rooms.

Co-authored-by: openhands <openhands@all-hands.dev>

app/controllers/messages/by_bots_controller.rb

@@ -10,8 +10,13 @@ class Messages::ByBotsController < MessagesController
   end
 
   def create
-    super
+    set_room
+    @message = @room.messages.create_with_attachment!(message_params)
+    @message.broadcast_create
+    deliver_webhooks_to_bots
     head :created, location: message_url(@message)
+  rescue ActiveRecord::RecordNotFound
+    head :not_found
   end
 
   private

test/controllers/messages/by_bots_controller_test.rb

@@ -93,7 +93,7 @@ class Messages::ByBotsControlleTest < ActionDispatch::IntegrationTest
     assert_response :redirect  # Redirects to login
   end
 
-  test "index returns 404 for room bot is not a member of" do
+  test "index returns not_found for room bot is not a member of" do
     # bender bot is NOT a member of the designers room
     room_without_bot = rooms(:designers)
     get room_bot_messages_index_url(room_without_bot, users(:bender).bot_key)
@@ -107,6 +107,15 @@ class Messages::ByBotsControlleTest < ActionDispatch::IntegrationTest
     assert_response :success
   end
 
+  test "create returns not_found for room bot is not a member of" do
+    # bender bot is NOT a member of the designers room - verify create matches index behavior
+    room_without_bot = rooms(:designers)
+    assert_no_difference -> { Message.count } do
+      post room_bot_messages_url(room_without_bot, users(:bender).bot_key), params: +"Hello!"
+    end
+    assert_response :not_found
+  end
+
   test "regular messages index still denied for bots" do
     # The standard messages endpoint (not the bot-specific one) should still be forbidden
     get room_messages_url(@room, bot_key: users(:bender).bot_key)