Watch: drop `decimal` 3.0 override once Ecto widens its constraint

Background

PR #4789 bumped decimal from 2.x to 3.1.0 to clear
GHSA-rhv4-8758-jx7v (unbounded exponent DoS in Decimal.new).
Ecto pins decimal ~> 2.0, so we ship the bump as an override: true
in mix.exs:

# Ecto pins ~> 2.0, but decimal 3.0 is API-compatible and patches
# GHSA-rhv4-8758-jx7v (unbounded exponent DoS in `Decimal.new`).
{:decimal, "~> 3.0", override: true},

decimal 3.x is API-compatible with 2.x for our usage, but the override
is mildly fragile — it means we're carrying an Ecto-unsupported version
combination that we have to keep an eye on whenever Ecto upgrades.

This is not a security concern — the patch is in place. It's a
clean-up so we can remove the override and trust Ecto's own constraint.

Unblock when

Ecto's mix.exs widens its decimal requirement to allow ~> 3.0 (or
later). Signals:

• A new Ecto release whose CHANGELOG mentions a decimal bump.
• hexdocs.pm/ecto/changelog.html referencing decimal 3.x.
• A mix deps.update ecto no longer downgrades decimal.

Action when unblocked

1. Remove the {:decimal, "~> 3.0", override: true} entry from mix.exs.
2. Remove the explanatory comment above it.
3. Run mix deps.get and confirm decimal stays on 3.x via Ecto's own
   constraint.
4. mix test to confirm nothing regresses.

Recheck cadence

Whenever we next bump Ecto, or quarterly — whichever comes first.

Wait for an Ecto release or dependency update that permits decimal 3.x, checking the Ecto changelog or running mix deps.update ecto. Then edit mix.exs to remove the decimal override and comment, run mix deps.get, and confirm with mix test that decimal remains on 3.x and the suite passes.