test(authz): end-to-end integration coverage, worked example, and docs

Task 15 of the authz permissions plan: proves db store + cache + catalog +
middleware + audit compose correctly, wires a real (non-dangling) example
into auth-showcase, and documents the declaration/registration/precedence
surface in the package README.

examples/auth-showcase/test/showcase.test.ts

@@ -91,3 +91,23 @@ test("package auth schemas are shared by browser forms and API handlers", () =>
   expect(forgotPassword).toContain("data-schema='{schema}'");
   expect(forgotPassword).toContain("novalidate");
 });
+
+test("authz is wired with a real declaration and a registered middleware, not a dangling file", () => {
+  expect(existsSync(join(root, "app", "authz", "showcase.ts"))).toBe(true);
+  expect(existsSync(join(root, "app", "middleware", "authz.ts"))).toBe(true);
+
+  const declaration = read(root, "app", "authz", "showcase.ts");
+  expect(declaration).toContain("defineAuthz");
+  expect(declaration).toContain('"post:read": { title: "View posts", public: true }');
+  expect(declaration).toContain("bindings:");
+
+  const middleware = read(root, "app", "middleware", "authz.ts");
+  expect(middleware).toContain("authzMiddleware");
+  expect(middleware).toContain("getAuthzCatalog()");
+  expect(middleware).toContain("memoryPermissionStore()");
+
+  const manifest = JSON.parse(read(root, "package.json")) as {
+    dependencies?: Record<string, string>;
+  };
+  expect(manifest.dependencies?.["@wrnexus/authz"]).toBe("workspace:*");
+});