feat(authz): generate Permission and Role union types

Emits sorted TS unions from the merged catalog so a typo in
can(ctx, "post:wrtie") is a compile-time error. Uses JSON.stringify
for string-literal escaping (not manual backslash/quote replace) so
role names containing raw newlines still produce valid TypeScript;
role names are not regex-validated like permission ids, so this
matters for the raw mergeCatalogs path.

packages/authz/src/index.ts

@@ -167,3 +167,4 @@ export type {
   SubjectAssignments,
 } from "./types.ts";
 export type { AuthorizeDecisionOptions } from "./advanced.ts";
+export { generatePermissionTypes } from "./codegen.ts";