fix(router): quietly skip permissions.gen.{ts,js} in authz scan

Task 10 fix round 1: the coordinator's plan doc (41fb82b9) recorded that
generated authz type files should be skipped before the isSafeIslandName
check, but the code change never landed. isSafeIslandName rejects the dot
in the stripped basename "permissions.gen", so every app running Task 12's
codegen would warn on every boot.

Add a quiet skip for *.gen.ts / *.gen.js immediately after the extension
guard, before the name check. Add tests: a .gen.ts file is skipped without
a console.warn (spied), and a .gen.js file is skipped the same way while a
legitimately named .js declaration is still discovered.

Also corrects the scanDir extraExtensions doc comment, which incorrectly
implied app/schemas passes it too (only app/authz does).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/router/src/index.ts

@@ -290,6 +290,10 @@ export function buildRouter(appDir: string, opts: RouterOptions = {}): Router {
   const authz: ComponentRef[] = [];
   for (const f of scanDir(join(appDir, "authz"), [".js"])) {
     if (!/\.(ts|js)$/.test(f.file)) continue;
+    // Generated type files (permissions.gen.ts) live here too. Skip them quietly:
+    // they export types only, and isSafeIslandName would otherwise reject the dot
+    // and warn on every boot.
+    if (/[.]gen[.](ts|js)$/.test(f.file)) continue;
     const name = basename(f.file).replace(/\.(ts|js)$/, "");
     if (!isSafeIslandName(name)) {
       console.warn(`[wrnexus] skipping authz declaration with unsafe name: ${name}`);

packages/router/src/scan.ts

@@ -33,10 +33,11 @@ function isIgnored(name: string): boolean {
  * Recursively collect allowed route files under `baseDir`.
  * Returns [] if the directory does not exist (a route kind may be unused).
  *
- * `extraExtensions` widens the allow-list for callers that scan non-route
- * directories (e.g. `app/schemas`, `app/authz`) and accept plain `.js`
- * modules; it defaults to empty so route scanning (`app/pages`, `app/api`,
- * `app/realtime`, ...) is unaffected.
+ * `extraExtensions` widens the allow-list for a caller that scans a non-route
+ * directory and accepts plain `.js` modules (currently only `app/authz`); it
+ * defaults to empty so every other caller — route scanning (`app/pages`,
+ * `app/api`, `app/realtime`, ...) as well as `app/schemas`, which does not
+ * pass it and so still only sees `.ts`/`.tsx`/`.wrn` — is unaffected.
  */
 export function scanDir(baseDir: string, extraExtensions: readonly string[] = []): ScannedFile[] {
   if (!existsSync(baseDir)) return [];