feat: complete SSR CRM and refine auth UI

examples/crm-app/app/middleware/authz.ts

@@ -0,0 +1,11 @@
+import { authzMiddleware, getAuthzCatalog } from "@wrnexus/authz";
+import { getDb } from "@wrnexus/db";
+import { dbPermissionStore } from "@wrnexus/authz/db";
+import type { Middleware } from "@wrnexus/core";
+
+// Production imports middleware before it opens configured databases. Resolve
+// the SQL-backed store on the first request, after runtime initialization.
+const middleware: Middleware = (ctx, next) =>
+  authzMiddleware({ catalog: getAuthzCatalog(), store: dbPermissionStore(getDb()) })(ctx, next);
+
+export default middleware;

examples/crm-app/app/middleware/protected.ts

@@ -0,0 +1,18 @@
+import { requireAuth } from "@wrnexus/auth";
+import { can } from "@wrnexus/authz";
+import type { Middleware } from "@wrnexus/core";
+
+const guard = requireAuth({ loginPath: "/login" });
+const protectedPrefixes = ["/dashboard", "/contacts", "/deals", "/admin"];
+
+const middleware: Middleware = (ctx, next) => {
+  if (!protectedPrefixes.some((prefix) => ctx.url.pathname.startsWith(prefix))) return next();
+  return guard(ctx, async () => {
+    if (ctx.url.pathname.startsWith("/admin") && !(await can(ctx, "admin:access"))) {
+      return Response.redirect(new URL("/forbidden", ctx.url), 303);
+    }
+    return next();
+  });
+};
+
+export default middleware;