feat(authz): reach the merged catalog from boot via a process-wide singleton

Fix round 1 for Task 14 — closes the gap flagged in the last report:
loadAppAuthzCatalog existed but nothing called it.

- packages/authz/src/client.ts (new): setAuthzCatalog/getAuthzCatalog/
  hasAuthzCatalog, mirroring @wrnexus/db's client.ts. App middleware runs
  at module-eval time and needs the catalog then, so ctx cannot carry it;
  getAuthzCatalog() throws a setup error naming the fix, like getDb() does.
  Exported from packages/authz/src/index.ts.
- packages/dev-server/src/index.ts: startServer calls loadAppAuthzCatalog +
  setAuthzCatalog before middleware is resolved (schemasJs precedent),
  and populates the new RuntimeDeps.authz field.
- packages/dev-server/src/runtime.ts: RuntimeDeps gains authz?: AuthzCatalog.
- packages/cli/src/build.ts: emits static imports of each app/authz/*.ts
  file into the generated entry (components/layouts precedent) and passes
  { source, module } pairs through ProdOptions.authz — the catalog holds
  policy functions, so it cannot be JSON-baked like schemasJs.
- packages/dev-server/src/prod.ts: createProductionHandlers merges those
  declarations and calls setAuthzCatalog before the server accepts
  traffic, so a conflict fails the boot instead of surfacing on the first
  request. Runs for every deployment adapter, not only Bun.serve.

The framework never installs authzMiddleware itself; the app still
registers it with its own store.

Verified end-to-end: added a temporary app/authz declaration to
examples/basic-app, ran `bun run build`, inspected the generated entry's
static import + authz array, and booted dist/server.js to confirm the
merge/setAuthzCatalog call succeeds against real bundled code (reverted
before commit).

packages/cli/src/build.ts

@@ -604,6 +604,24 @@ export async function runBuild(appRoot: string): Promise<void> {
     .join(", ");
   if (router.layouts.length) console.log(`✓ Layouts: ${router.layouts.length}`);
 
+  // Authorization declarations (app/authz/*.ts), statically imported like
+  // components/layouts — NOT baked into JSON like schemasJs, because the
+  // catalog contains policy FUNCTIONS, which JSON.stringify cannot carry.
+  // Each module is passed through by reference in ProdOptions.authz and
+  // merged into the process-wide catalog at prod startup (prod.ts), before
+  // the server begins listening, so a conflicting pair of declarations fails
+  // the boot instead of surfacing on the first request. A file with no
+  // default export becomes `module: undefined` here; prod.ts warns and skips
+  // it, matching the dev loader (authz-boot.ts).
+  const authzLit = router.authz
+    .map((a) => {
+      const v = `az${counter++}`;
+      imports.push(`import * as ${v} from ${JSON.stringify(fwd(a.file))};`);
+      return `{ source: ${JSON.stringify(fwd(a.file))}, module: ${v}.default }`;
+    })
+    .join(", ");
+  if (router.authz.length) console.log(`✓ Authz: ${router.authz.length} declaration(s)`);
+
   const entry = `// AUTO-GENERATED production server entry — do not edit.
 import { join } from "node:path";
 import { createProductionServer } from ${JSON.stringify(PROD_MODULE)};
@@ -627,6 +645,7 @@ await createProductionServer(
     uiCssPath: join(import.meta.dir, "ui.css"),
     frameworkCssPath: join(import.meta.dir, "framework.css"),
     schemasJs: ${JSON.stringify(schemasJs)},
+    authz: [${authzLit}],
     i18n: ${i18n ? JSON.stringify(i18n) : "undefined"},
     db: ${config.db ? JSON.stringify(config.db) : "undefined"},
     databases: ${config.databases ? JSON.stringify(config.databases) : "undefined"},