feat(router): discover app/authz declarations

Scan app/authz/<name>.{ts,js} the same way app/schemas is scanned,
exposing Router.authz: ComponentRef[]. Also update the two other
literal Router construction sites (prod runtime, dev-server test
fixture) that now need the new required field.

scanDir gains an optional extraExtensions parameter (default []) so
the authz scan can accept .js files without widening the extension
allow-list used by route scanning (app/pages, app/api, app/realtime),
which would otherwise leak .js into generated route URLs via
fileToRoute.

packages/dev-server/test/observability-runtime.test.ts

@@ -13,6 +13,7 @@ function runtime(health: HealthRegistry, trustProxy = false) {
     layouts: [],
     stores: [],
     schemas: [],
+    authz: [],
     matchPage: () => null,
     matchApi: () => null,
     matchRealtime: () => null,