proto: hide module from public surface; drop dead decode_error_message (#575)

* proto: hide module from public surface; drop dead decode_error_message

pub mod proto → pub(crate) mod proto (lib.rs); both child modules
(encoders, decoders) likewise pub(crate). The raw protobuf bindings
were a generated mirror of upstream .proto files — any field rename
would have been a silent breaking change for any downstream importer.
Zero external consumers verified across examples/, integration/,
docs/, README.md.

Narrowing surfaced dead code:
- decode_error_message (dead since #450; test names string-match
  but never call it) — deleted, plus the now-unused prost::Message
  import in proto/decoders.rs.
- Three prost-generated *End structs (OpenOrdersEnd, PositionEnd,
  CompletedOrdersEnd) used only in #[cfg(test)] testdata builders —
  dead_code allowed at the proto module root alongside the existing
  missing_docs / clippy::all suppressions on the generated content.

Migration guide §16 added.

PR 2 of plans/hide-internal-types.md.

* proto: drop redundant #[allow(clippy::all)] on decoders module

The file-scope #![allow(clippy::all)] in src/proto/mod.rs already covers
child modules; the per-module attribute was dead. /simplify nit.