feat(router): discover app/authz declarations

Scan app/authz/<name>.{ts,js} the same way app/schemas is scanned,
exposing Router.authz: ComponentRef[]. Also update the two other
literal Router construction sites (prod runtime, dev-server test
fixture) that now need the new required field.

scanDir gains an optional extraExtensions parameter (default []) so
the authz scan can accept .js files without widening the extension
allow-list used by route scanning (app/pages, app/api, app/realtime),
which would otherwise leak .js into generated route URLs via
fileToRoute.

packages/router/src/scan.ts

@@ -32,8 +32,13 @@ function isIgnored(name: string): boolean {
 /**
  * Recursively collect allowed route files under `baseDir`.
  * Returns [] if the directory does not exist (a route kind may be unused).
+ *
+ * `extraExtensions` widens the allow-list for callers that scan non-route
+ * directories (e.g. `app/schemas`, `app/authz`) and accept plain `.js`
+ * modules; it defaults to empty so route scanning (`app/pages`, `app/api`,
+ * `app/realtime`, ...) is unaffected.
  */
-export function scanDir(baseDir: string): ScannedFile[] {
+export function scanDir(baseDir: string, extraExtensions: readonly string[] = []): ScannedFile[] {
   if (!existsSync(baseDir)) return [];
 
   const out: ScannedFile[] = [];
@@ -45,7 +50,10 @@ export function scanDir(baseDir: string): ScannedFile[] {
       const stats = statSync(abs);
       if (stats.isDirectory()) {
         walk(abs);
-      } else if (stats.isFile() && hasAllowedExtension(entry)) {
+      } else if (
+        stats.isFile() &&
+        (hasAllowedExtension(entry) || extraExtensions.some((ext) => entry.endsWith(ext)))
+      ) {
         out.push({
           file: abs,
           rel: relative(baseDir, abs).split(sep).join("/"),