Release MakePay SDK 0.4.0 with OAuth and DPoP

[orangebtc]

Summary

• release @makecrypto/makepay 0.4.0 with optional OAuth/DPoP authentication while preserving keyId/keySecret construction
• add controlled 401 refresh retry, idempotency keys, webhook-subscription methods, and hardened error/network handling
• add trusted-publishing workflow with immutable candidate and provenance checks

Validation

• exact head: 248f23a
• Node 18, 22, and 24 CI passed on the identical commit before this visible replacement PR
• package allowlist, type declarations, tests, build, audit, and packed artifact checks passed
• frozen SDK artifact sha256: b597fc487f3be8829655505d5bbc2966eb02b80421ca6cf8a57d9a507d324672

This visible PR replaces an account-scoped hidden PR authored by jamesw383. It points to the exact same reviewed commit; fresh CI is required before merge.