fix: apply inference restriction to SageMaker MME invoke path

The SageMaker multi-model custom-invoke route (POST /models/{model}/invoke)
is dispatched to SageMakerMMEHandleInfer() without checking the inference
API restriction. When --http-restricted-api=inference is configured, the
standard HTTP infer, the gRPC infer, and the SageMaker /invocations routes
all enforce the required header (the last via the inherited HandleInfer),
but the MME invoke route runs inference without it. This mirrors the MME
model-repository gap closed in #8686, which did not cover the invoke route.

Add the existing RETURN_AND_RESPOND_IF_RESTRICTED(req,
RestrictedCategory::INFERENCE) guard at the top of the /invoke branch,
matching the base HandleInfer/HandleGenerate handlers and the sibling MME
repository branches. No behavior change when no inference restriction is set.

Signed-off-by: LinZiyuu <linziyu0205@163.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: LinZiyuu

src/sagemaker_server.cc

@@ -199,6 +199,9 @@ SagemakerAPIServer::Handle(evhtp_request_t* req)
         if (action == "/invoke") {
           LOG_VERBOSE(1) << "SageMaker request: INVOKE MODEL";
 
+          RETURN_AND_RESPOND_IF_RESTRICTED(
+              req, RestrictedCategory::INFERENCE);
+
           {
             std::lock_guard<std::mutex> lock(models_list_mutex_);
             if (sagemaker_models_list_.find(multi_model_name.c_str()) ==