RPC scope authorization decoded the settings payload a second time after
the RPC server had already decoded it. Duration intervals were already
Duration objects, so the second decode threw, and because the throw was
synchronous inside middleware the server reported it as a connection
defect.

Authorization now reads the decoded payload directly. The same applies to
asset URLs, project mutations, and the prepare pull request thread scope
check. Scope calculation runs inside Effect.suspend so a throw fails only
its request.

Fixes #17233