Remove unused number dependency to unblock decimal 3.x

[Flo0807]

Problem

The number package (last released April 2024) pins decimal to ~> 1.5 or ~> 2.0. Since decimal 3.0 shipped — including a security fix — this transitive chain decimal -> number -> backpex blocked us from updating. ecto_sql v3.14.0 requires decimal 3.0, so it was the first package we could no longer update.

Root cause

Backpex has not actually used number since 71757de (PR #541, 2024-08-26). That commit removed the only call site from Backpex.HTML.pretty_value/1:

def pretty_value(input) when is_integer(input),
  do: Number.Delimit.number_to_delimited(input, precision: 0, delimiter: ".")

Formatting became the caller's responsibility, but {:number, "~> 1.0"} was left behind in mix.exs. It kept being resolved into mix.lock ever since, without a single call site in lib/.

This never surfaced because mix deps.unlock --unused (part of mix lint) only checks whether a lock entry is still required by mix.exs — not whether the code actually calls the package. As long as it was declared, it counted as "used".

Changes

• Remove {:number, "~> 1.0"} from Backpex.
• Replace the two remaining demo usages (post_live.ex, product_live.ex) with a local DemoWeb.NumberFormat.to_delimited/1 helper, preserving the previous formatting behaviour including nil handling. Added unit tests + doctests.
• number is now gone from the repository entirely.

No alternative library needed — the library never used it.

Result

This unblocks, for both the library and the demo:

Package	Before	After
decimal	2.4.1	3.1.1
ecto	3.13.6	3.14.1
ecto_sql	3.13.5	3.14.0

Verification

• mix lint passes (compile --warning-as-errors, deps.unlock --unused, format, credo, 100 doctests + 174 tests, 0 failures).
• Demo compiles cleanly; credo clean; new NumberFormat tests pass (3 doctests, 5 tests).

Note for reviewers

The decimal/ecto/ecto_sql bumps in the lockfiles are arguably a separate concern and could be left to Renovate. They are included here as proof that the block is actually gone — happy to drop them from this PR if you prefer it scoped purely to removing number.