CVE-2026-70484: Open WebUI: Users denied the image-generation permission can still generate images via chat completions

An authenticated user whose features.image_generation permission has been revoked can still make the server generate images by sending the feature flag in a chat-completion request. The chat pipeline took the client-supplied features object at face value and never re-checked the permission that the direct image routes enforce, so the denial applied to the UI affordance but not to the server-side generation path.