Unbound message creation returns 404 while integration contract expects 400

[phantomii]

Summary

test_unbound_user_cannot_send_message fails on the clean default-branch state because the API returns 404 RecordNotFound, while the integration contract expects HTTP 400.

Steps to reproduce

1. Apply all migrations to an empty PostgreSQL database.
2. Create a private stream and bind it only to user B.
3. Create a topic in that stream.
4. Authenticate as unbound user A.
5. Send POST /api/messenger/v1/messages/ with the stream UUID, topic UUID, and a valid Markdown payload.

Expected result

The request is rejected with HTTP 400, as asserted by the existing integration test.

Actual result

The request is rejected with HTTP 404. The response type is RecordNotFound, reporting that no visible WorkspaceUserStream row exists for user A.

Reproduction evidence

• Reproduced on clean commit 77a5b35.
• Reproduced independently in an isolated local test environment with PostgreSQL 18.4 and Python 3.14.
• The focused test result is 1 failed; no application changes are required to trigger it.

Impact

The integration suite is red on a clean checkout, and the intended public error-status contract for an unbound sender is ambiguous.

Notes

Observed fact: visibility lookup raises RecordNotFound, which the error middleware maps to 404.

Hypothesis: either the test's expected status is stale, or message creation should translate this visibility failure into a validation error. The desired contract should be selected explicitly before changing code or the test.