feat(plugins): let a plugin register its own authz-schema actions

[zumbrunn]

What

DunePlugin.authzActions lets a plugin declare a new admin-permission action (e.g. "billing.manage") and gate a route behind it the same correct way every built-in admin route is (authz.check()), instead of reusing an existing, semantically mismatched permission or hand-rolling a check outside the authz system entirely.

Closes the "Plugin-extensible authz schema" backlog item.

Design

• Relation-only: a plugin action can require existing relations (member/admin/editor/author/owner), not define a new relation type — covers the actual motivating case without opening the harder question of arbitrary plugin-defined relation semantics.
• src/auth/authz-schema.ts: the module-level duneAuthzSchema constant is now buildDuneAuthzSchema()'s zero-argument output (built-ins only) — unaffected for any existing caller reading it directly (tests, headless usage). bootstrap() calls the same builder with plugin-contributed actions merged in, once per site.
• Collision handling: bootstrap.ts collects every plugin's authzActions after setup() has run, before the authz system is created. A name colliding with a built-in action or another plugin's is dropped with a logged warning, not silently merged — first declaration wins in registration order.
• Multisite-safe by construction: the merged schema lives on BootstrapResult.authzSchema, not a process-wide singleton, so one site's plugin action can't leak into another's schema.
• roleHasPermission() (the one synchronous permission-check path, ResponseTransformContext.auth.hasPermission()) gains an optional third parameter — a site's actual actionToRelations map — so it resolves a plugin-contributed action correctly instead of only ever seeing the built-ins.

Companion change

Needs a matching @dune/plugin-admin change (widening AdminPermission from a closed union to accept any string) for a plugin author to actually pass a custom action through withGuards()/requirePermission() without a type-level workaround — separate PR: duneorg/plugin-admin#5.

Testing

• New tests/auth/authz_plugin_actions_test.ts — real bootstrap() + real authz.check() end to end, including both collision cases (built-in and cross-plugin).
• Unit coverage added to tests/auth/authz_schema_test.ts for buildDuneAuthzSchema()/roleHasPermission()'s new parameter.
• Full suite: deno test -A tests/ — 1815 passed, 0 failed.
• deno task check (lint + typecheck + dynamic-import-lint) clean.

Note on versioning

This is folded into the existing, still-unpublished ## [0.34.4] CHANGELOG entry rather than a new version bump — deno.json stays at 0.34.4 since that version hasn't published to JSR yet.

🤖 Generated with Claude Code