favorites: convert user.hide_favorites? to pundit.

test/functional/recommended_posts_controller_test.rb

@@ -36,6 +36,12 @@ class RecommendedPostsControllerTest < ActionDispatch::IntegrationTest
         assert_select ".recommended-posts"
         assert_select ".recommended-posts #post_#{@post.id}"
       end
+
+      should "not show recommendations for users with private favorites to other users" do
+        @other_user = create(:user, enable_private_favorites: true)
+        get_auth recommended_posts_path(search: { user_id: @other_user.id }), @user
+        assert_response 403
+      end
     end
   end
 end