feat(router): discover app/authz declarations

Scan app/authz/<name>.{ts,js} the same way app/schemas is scanned,
exposing Router.authz: ComponentRef[]. Also update the two other
literal Router construction sites (prod runtime, dev-server test
fixture) that now need the new required field.

scanDir gains an optional extraExtensions parameter (default []) so
the authz scan can accept .js files without widening the extension
allow-list used by route scanning (app/pages, app/api, app/realtime),
which would otherwise leak .js into generated route URLs via
fileToRoute.

packages/dev-server/src/prod.ts

@@ -239,6 +239,7 @@ function buildProdRouter(manifest: ProdManifest): {
     layouts: manifest.layouts.map((l) => ({ name: l.name, file: `layout:${l.name}` })),
     stores: [],
     schemas: [], // descriptors are pre-baked into schemasJs; not needed at runtime
+    authz: [], // authz declarations are not needed at runtime in production
     matchPage: optimizedMatcher(pages),
     matchApi: optimizedMatcher(api),
     matchRealtime: optimizedMatcher(realtime),