chore(release): prepare v0.4.0

[voyvodka]

Cuts the v0.4.0 section from Unreleased in CHANGELOG.md, bumps the WebhookEngine.Sdk package version, and syncs the roadmap header.

Contents of v0.4.0 (22 commits since v0.3.1):

• Security — authenticated SignalR delivery hub (cross-tenant leak), connect-time IP-allowlist enforcement (DNS rebinding), login rate limiting, portal endpoint-test header redaction.
• Fixed — delivery-lifecycle hardening (double delivery, lost attempt rows, state regression), failed-enqueue message loss, race-safe manual retry, circuit-open retry-budget burn, bounded list pagination and UTC date filters, dashboard live-refresh freeze past the 20-event cap, query-performance indexes and a streaming endpoint-stats p95.
• Added — operator backlog gauges (queue_depth, queue_oldest_pending_age, circuit_open).
• Changed — backend, frontend, and CI/base-image dependency refreshes (this ship cycle's nine Dependabot PRs).

Minor bump rather than patch: the release adds new user-visible Prometheus metrics, and webhookengine_queue_depth changes semantics (drifting up/down counter → real gauge) while endpoint-stats p95 moves to a continuous-interpolated percentile.

No breaking API changes — the v1 prefix, the Standard Webhooks signature surface, and the WebhookEngine.Sdk public API are unchanged.