chore(release): bump to 0.4.0

refactor(profile): redesign user settings form, unify navbar

fix(docker): add timeout to HEALTHCHECK urlopen

docs(audit): triage low findings per LAN context, 1 unfixed remaining

fix(auth): require authentication on OTP verify endpoint

docs(audit): triage remaining medium issues per LAN context, fix stats, document original audit discrepancy

docs(audit): mark Alembic (#13) as skipped, update stats

docs: update audit tracker and architecture doc for #3, #15, #22

refactor(config): centralize settings with pydantic-settings

refactor(web): use schedule_service.toggle_active for archive/restore

refactor(web): deduplicate require_auth + get_by_id into require_db_user helper

docs(api): add summary= and response_model to all route decorators

fix(observability): disable OpenAPI docs in production by default

fix(auth): enforce minimum password length of 8 characters

fix(logging): conditionally lower log level for production, clarify .env convention in docs

docs: mark SECRET_KEY centralization fix in audit journal (01f93be)

refactor(config): centralize SECRET_KEY to single source in security.py

docs: mark request/correlation ID fix in audit journal (b263fad)

feat(observability): add request/correlation ID tracking middleware

docs: mark logging.conf fix in audit journal (14a00e4)

fix(logging): load orphaned logging.conf at app startup

docs: mark database indexes fix in audit journal (06054e1)

fix(db): add missing indexes on FK columns and compound index on intakes

docs: fix audit journal statistics (4 high unfixed remaining)

docs: mark OTP TTL cache fix in audit journal (759fed3)

chore: remove accidental =5.5.0 file from pip redirect

fix(telegram): replace OTP dict with TTLCache to prevent memory leak