Reviewer-run fixes (todo §4); re-mint try/catch degrades an Ory outage to anonymous (not 500), RESERVED_PLUGIN_IDS refuses a plugin folder that would shadow a host route

src/plugin.ts

@@ -77,6 +77,13 @@ export function isValidPluginId(id: string): boolean {
   return PLUGIN_ID.test(id);
 }
 
+// Ids the host reserves for its own first-party mount segments (the auth flows, /auth/complete,
+// /logout, the dashboard's /public/ static). Plugin routes resolve before these, so a folder named
+// one of them would silently shadow a built-in route — discovery refuses it, loud like any conflict.
+export const RESERVED_PLUGIN_IDS: ReadonlySet<string> = new Set([
+  "auth", "login", "logout", "public", "recovery", "registration", "settings", "verification",
+]);
+
 export interface Semver {
   major: number;
   minor: number;