feat(authz): reach the merged catalog from boot via a process-wide singleton

Fix round 1 for Task 14 — closes the gap flagged in the last report:
loadAppAuthzCatalog existed but nothing called it.

- packages/authz/src/client.ts (new): setAuthzCatalog/getAuthzCatalog/
  hasAuthzCatalog, mirroring @wrnexus/db's client.ts. App middleware runs
  at module-eval time and needs the catalog then, so ctx cannot carry it;
  getAuthzCatalog() throws a setup error naming the fix, like getDb() does.
  Exported from packages/authz/src/index.ts.
- packages/dev-server/src/index.ts: startServer calls loadAppAuthzCatalog +
  setAuthzCatalog before middleware is resolved (schemasJs precedent),
  and populates the new RuntimeDeps.authz field.
- packages/dev-server/src/runtime.ts: RuntimeDeps gains authz?: AuthzCatalog.
- packages/cli/src/build.ts: emits static imports of each app/authz/*.ts
  file into the generated entry (components/layouts precedent) and passes
  { source, module } pairs through ProdOptions.authz — the catalog holds
  policy functions, so it cannot be JSON-baked like schemasJs.
- packages/dev-server/src/prod.ts: createProductionHandlers merges those
  declarations and calls setAuthzCatalog before the server accepts
  traffic, so a conflict fails the boot instead of surfacing on the first
  request. Runs for every deployment adapter, not only Bun.serve.

The framework never installs authzMiddleware itself; the app still
registers it with its own store.

Verified end-to-end: added a temporary app/authz declaration to
examples/basic-app, ran `bun run build`, inspected the generated entry's
static import + authz array, and booted dist/server.js to confirm the
merge/setAuthzCatalog call succeeds against real bundled code (reverted
before commit).

packages/dev-server/src/prod.ts

@@ -38,6 +38,7 @@ import { VALIDATE_RUNTIME } from "@wrnexus/validation";
 import { I18N_RUNTIME, type ResolvedI18n } from "@wrnexus/i18n";
 import { setDb, registerLazyDb, getDb, hasDb, migrate } from "@wrnexus/db";
 import { connectFromConfig } from "@wrnexus/db/connect";
+import { mergeCatalogs, setAuthzCatalog, type AuthzModule } from "@wrnexus/authz";
 import {
   configureStorage,
   serveStoredFile,
@@ -103,6 +104,15 @@ export interface ProdOptions {
   frameworkCssPath?: string;
   /** Pre-built `window.__wireSchemas = {...}` script for client validation. */
   schemasJs?: string;
+  /**
+   * Authorization declarations discovered by `wrnexus build` from
+   * `app/authz/*.ts`, statically imported into the generated entry (the
+   * catalog holds policy FUNCTIONS, so — unlike `schemasJs` — it cannot be
+   * JSON-serialised). `module` is `undefined` for a file with no default
+   * export; `createProductionHandlers` warns and skips it, then merges the
+   * rest into the process-wide catalog before the server accepts traffic.
+   */
+  authz?: { source: string; module?: AuthzModule }[];
   /** Resolved i18n bundle (default lang + locale messages). */
   i18n?: ResolvedI18n;
   /** Default database connection (driver + url); enables `getDb()`. */
@@ -353,6 +363,24 @@ export function createProductionHandlers(
   // (NOT dist/, which is rebuilt) so uploads persist across deploys.
   configureStorage(opts.storage, process.cwd());
 
+  // Authorization: merge the build's statically-imported app/authz/*.ts
+  // declarations into the process-wide catalog BEFORE the handlers (and thus
+  // any request) exist, so a conflicting pair of declarations fails the boot
+  // loudly instead of surfacing on the first request. This runs for every
+  // deployment adapter that calls createProductionHandlers, not only the
+  // Bun.serve path in createProductionServer below. The app still registers
+  // authzMiddleware itself with its own store; this only makes the merged
+  // catalog reachable. No declarations -> an empty catalog, no error.
+  const authzSources = (opts.authz ?? []).flatMap((entry) => {
+    if (!entry.module) {
+      console.warn(`[wrnexus] authz declaration ${entry.source} has no default export; skipping.`);
+      return [];
+    }
+    return [{ source: entry.source, module: entry.module }];
+  });
+  const authzCatalog = mergeCatalogs(authzSources);
+  setAuthzCatalog(authzCatalog);
+
   // Middleware is already an ordered array of functions.
   const getMiddleware = async (): Promise<Middleware[]> => manifest.middleware;
 
@@ -388,6 +416,7 @@ export function createProductionHandlers(
     security: opts.security,
     observability: opts.observability,
     tenancy: opts.tenancy,
+    authz: authzCatalog,
     navigation: opts.navigation,
     maxBodyBytes: opts.maxBodyBytes,
     realtimeBus: realtimeBusFromConfig(opts.realtime),