Sub-ticket of PLUTO-365 resolveDataAccessScope → fn_resolveDataAccessScope SQL fn + React cache() — collapse 3-4 round trips per protected render to 1; src/lib/access-scope.ts · pluto