Decode the base64url payload of an `HTTP2-Settings` header (RFC 7540 §3.2.1, RFC 7235 token68). Returns `None` for malformed input. Surrounding linear whitespace is tolerated: although token68 itself disallows whitespace, the header value can still arrive with surrounding LWS depending on upstream parsing.

The handler installed on `ConnectionFacade.Http2UpgradeHandler`. It owns the connection from the moment it is invoked: it writes the 101, marks the connection as long-lived (so the health checker leaves it alone), then runs the HTTP/2 connection-preface exchange before returning `Ok false` to break the HTTP/1.1 keep-alive loop.

Wire `handleUpgrade` into `ConnectionFacade.Http2UpgradeHandler`. Idempotent — safe to call from multiple bindings / restarts.

The 101 Switching Protocols response sent to acknowledge an h2c upgrade. RFC 7540 §3.2 requires `Connection: Upgrade` and `Upgrade: h2c`; the body MUST be empty.

Decode the `HTTP2-Settings` header value into a `Settings` record by reusing the wire-format SETTINGS parser. The base64url payload contains zero or more 6-octet (id,value) pairs — exactly the body of a SETTINGS frame, with no frame header — per RFC 7540 §3.2.1.