v0.4.0

Admin-POST and AAL2 step-up fixes, extensible Hydra CORS for browser-SPA
clients, the othala.dunn.dev docs site, and an ADR/docs rewrite that
stands the project alone. Full notes in CHANGELOG.md.