Release MakePay SDK 0.4.0 with OAuth and DPoP

[jamesw383]

Summary

• preserve API-key construction while adding async OAuth auth providers
• add RFC-aligned DPoP helpers, a controlled 401 refresh retry, and redirect credential stripping
• add idempotent payment-link mutations and grant-scoped webhook subscription methods
• publish an exact five-file artifact through npm trusted publishing to the next tag

Verification

• build and SDK tests pass
• packed install/import/DPoP smoke passes
• exact artifact allowlist and secret/source-map scan pass
• production and complete npm audits report zero vulnerabilities
• standalone and monorepo mirror tarballs are byte-for-byte identical
• CI covers Node 18, 22, and 24

Release sequence

After approval and green CI, merge this PR, configure the npm-release environment and npm trusted publisher for .github/workflows/publish.yml, tag the exact merge commit as v0.4.0, and publish the immutable candidate to next. Promote the same version to latest only after registry-artifact smoke testing.