[mroderick]

Upgrades Rails from 8.1.3.1 to 8.1.4. Rails 8.1.4 contains the fix that makes ActiveSupport::JSON.decode compatible with json 3.x, which is what blocks the dependabot json bump in #3051.

• The diff is Gemfile.lock only: the Rails family moves to 8.1.4, plus its pinned transitive deps (net-smtp, net-imap, net-protocol, marcel, rdoc).
• Dependabot does not open Rails PRs (.github/dependabot.yml ignores rails), so this upgrade happens by hand.
• After this merges, chore(deps): bump json from 2.21.2 to 3.1.0 #3051 needs a rebase; it already flips the json pin in the Gemfile.

Release notes review

The 8.1.4 changelog is bugfix-only: no deprecations, no removals, no config changes. I checked the behaviour changes against this codebase; none needs app changes here:

• Column defaults are no longer eagerly deserialized (reverts an 8.1.0 change). No model reads columns_hash defaults.
• accepts_nested_attributes_for :limit miscount fix. Only Sponsor uses nested attributes, without limit.
• serialize / store coder double-encoding fix. Neither is used.
• Selenium system-test fix does not apply (system specs drive Playwright) and Active Storage fixes do not apply (uploads use CarrierWave).

Changelog items reviewed, by framework

• Active Support: the json 3.x JSON.decode fix (the reason for this PR), number-helper fixes, Time#advance mutation fix, HashWithIndifferentAccess fixes.
• Active Model: integer coercion size limit (input hardening), normalizes re-run fix.
• Active Record: composite-primary-key fixes, accepts_nested_attributes_for :limit fix, column-default deserialization revert, schema cache sorting revert.
• Action Pack: session CacheStore fix, If-Modified-Since parsing of all RFC 9110 date formats, host authorization rejects malformed multi-port hosts.
• Railties: lazy route loading made thread-safe (helps concurrent first requests in dev/test).
• Active Storage / Action Cable / Active Job / Action Mailer: fixes that do not touch this app's usage.

Review notes

• Look at first: confirm the lockfile diff is only the Rails family plus its transitive deps, and spot-check the 8.1.4 release notes link in the summary against the review above.
• Deliberately not done: the json 3.x bump stays in chore(deps): bump json from 2.21.2 to 3.1.0 #3051, and the stale json pin comment in the Gemfile is left for that PR to resolve.