feat(authz): reach the merged catalog from boot via a process-wide singleton

Fix round 1 for Task 14 — closes the gap flagged in the last report:
loadAppAuthzCatalog existed but nothing called it.

- packages/authz/src/client.ts (new): setAuthzCatalog/getAuthzCatalog/
  hasAuthzCatalog, mirroring @wrnexus/db's client.ts. App middleware runs
  at module-eval time and needs the catalog then, so ctx cannot carry it;
  getAuthzCatalog() throws a setup error naming the fix, like getDb() does.
  Exported from packages/authz/src/index.ts.
- packages/dev-server/src/index.ts: startServer calls loadAppAuthzCatalog +
  setAuthzCatalog before middleware is resolved (schemasJs precedent),
  and populates the new RuntimeDeps.authz field.
- packages/dev-server/src/runtime.ts: RuntimeDeps gains authz?: AuthzCatalog.
- packages/cli/src/build.ts: emits static imports of each app/authz/*.ts
  file into the generated entry (components/layouts precedent) and passes
  { source, module } pairs through ProdOptions.authz — the catalog holds
  policy functions, so it cannot be JSON-baked like schemasJs.
- packages/dev-server/src/prod.ts: createProductionHandlers merges those
  declarations and calls setAuthzCatalog before the server accepts
  traffic, so a conflict fails the boot instead of surfacing on the first
  request. Runs for every deployment adapter, not only Bun.serve.

The framework never installs authzMiddleware itself; the app still
registers it with its own store.

Verified end-to-end: added a temporary app/authz declaration to
examples/basic-app, ran `bun run build`, inspected the generated entry's
static import + authz array, and booted dist/server.js to confirm the
merge/setAuthzCatalog call succeeds against real bundled code (reverted
before commit).

packages/dev-server/test/authz-startserver.test.ts

@@ -0,0 +1,103 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { getAuthzCatalog, hasAuthzCatalog } from "@wrnexus/authz";
+import { startServer } from "../src/index.ts";
+
+// Fixtures live inside the repo tree, not os.tmpdir(): a scaffolded file under
+// app/authz importing "@wrnexus/authz" by bare specifier resolves via the root
+// tsconfig.json `paths` map, walked from the *imported file's* location — an
+// out-of-tree path (os.tmpdir(), often a different drive on Windows) never
+// reaches it.
+const scratchRoot = join(import.meta.dir, ".tmp-authz-startserver");
+mkdirSync(scratchRoot, { recursive: true });
+
+function scaffold(name: string, authzFiles: Record<string, string>): string {
+  const root = mkdtempSync(join(scratchRoot, `${name}-`));
+  const appDir = join(root, "app");
+  mkdirSync(join(appDir, "pages"), { recursive: true });
+  writeFileSync(
+    join(root, "package.json"),
+    JSON.stringify({ name: `authz-startserver-${name}` }),
+    "utf8",
+  );
+  if (Object.keys(authzFiles).length) {
+    mkdirSync(join(appDir, "authz"), { recursive: true });
+    for (const [file, body] of Object.entries(authzFiles)) {
+      writeFileSync(join(appDir, "authz", file), body, "utf8");
+    }
+  }
+  return appDir;
+}
+
+afterAll(() => {
+  rmSync(scratchRoot, { recursive: true, force: true });
+});
+
+describe("dev boot loads the authz catalog before middleware is resolved", () => {
+  test("an app with declarations makes getAuthzCatalog() return them after boot", async () => {
+    const appDir = scaffold("has-decls", {
+      "main.ts": `import { defineAuthz } from "@wrnexus/authz";
+export default defineAuthz({ permissions: { "post:read": { title: "View posts" } } });`,
+    });
+    const server = await startServer({
+      appDir,
+      hostname: "127.0.0.1",
+      port: 0,
+      mode: "development",
+      hmr: false,
+    });
+    try {
+      expect(hasAuthzCatalog()).toBe(true);
+      expect(getAuthzCatalog().permissions.has("post:read")).toBe(true);
+    } finally {
+      server.stop();
+    }
+  });
+
+  test("an app with no app/authz declarations boots without throwing", async () => {
+    const appDir = scaffold("no-decls", {});
+    const server = await startServer({
+      appDir,
+      hostname: "127.0.0.1",
+      port: 0,
+      mode: "development",
+      hmr: false,
+    });
+    try {
+      expect(getAuthzCatalog().permissions.size).toBe(0);
+    } finally {
+      server.stop();
+    }
+  });
+
+  test("a conflicting pair of declarations fails the boot, naming both source files", async () => {
+    const appDir = scaffold("conflict", {
+      "a.ts": `import { defineAuthz } from "@wrnexus/authz";
+export default defineAuthz({ permissions: { "post:read": { risk: "low" } } });`,
+      "b.ts": `import { defineAuthz } from "@wrnexus/authz";
+export default defineAuthz({ permissions: { "post:read": { risk: "high" } } });`,
+    });
+
+    let thrown: unknown;
+    try {
+      const server = await startServer({
+        appDir,
+        hostname: "127.0.0.1",
+        port: 0,
+        mode: "development",
+        hmr: false,
+      });
+      // Should be unreachable; stop it anyway so a regression doesn't leak a port.
+      server.stop();
+    } catch (error) {
+      thrown = error;
+    }
+
+    expect(thrown).toBeInstanceOf(Error);
+    const message = (thrown as Error).message;
+    expect(message).toContain("WRN-AUTHZ-CONFLICT");
+    expect(message).toContain(join(appDir, "authz", "a.ts"));
+    expect(message).toContain(join(appDir, "authz", "b.ts"));
+  });
+});