fix: keep authz server modules out of browser bundles

packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/auth",
-  "version": "0.8.15",
+  "version": "0.8.16",
   "description": "Complete authentication, account security, MFA, passkeys, recovery, devices, risk, and audit system for WRNexusJS.",
   "type": "module",
   "sideEffects": false,

packages/auth/src/http/index.ts

@@ -11,7 +11,7 @@ import {
 import { resolveAuthSchemas, type AuthSchemaOverrides, type AuthSchemaSet } from "../validation.ts";
 import type { AuthSessionVerificationHandler } from "../types.ts";
 import { completeAuth, startAuth, type OAuthProvider } from "@wrnexus/oauth";
-import { assignDefaultAuthzRoles } from "@wrnexus/authz";
+import { assignDefaultAuthzRoles } from "@wrnexus/authz/defaults";
 
 function text(value: unknown): string {
   return typeof value === "string" ? value : value == null ? "" : String(value);