chore(main): release 1.4.0

[github-actions]

🤖 I have created a release beep boop

1.4.0 (2026-07-02)

Features

• add /readyz readiness probe with database check (#113) (36b8dad)
• add structured logging with request correlation (#115) (4290278)
• configure explicit Postgres connection pool and timeouts (#114) (7d638cb)
• validate environment variables at startup with a typed config (#121) (e7bc114)

Bug Fixes

• a11y: add id=main-content to marketing layout main (#94) (096beaa), closes #76
• auth: harden post-login redirect validation (#125) (259c5ff)
• enforce Content-Security-Policy instead of report-only mode (#126) (0231588), closes #124
• log DNS resolver errors and differentiate by code (#90) (d7023c4), closes #88
• reject unknown fieldName in approveChangeRequest (#91) (3d9e41a), closes #87
• unify duplicate-key error detection into single helper (#92) (f1bfad2), closes #89

---

This PR was generated with Release Please. See documentation.

[dobby-coder]

Code review

release-please 1.3.1 → 1.3.2. CHANGELOG entry + version bumped in package.json and both locations in package-lock.json (lockfileVersion 3). The two fix: commits since v1.3.1 (#90, #92) are the changelog entries; the 4 chore: commits between releases are correctly excluded. Patch bump is correct semver for two fixes.

Rule compliance

64 rule/note checks (61 org rules + 3 repo-specific notes) ran in parallel against the diff. No genuine violations — the rules that flagged this PR did so on misapplied scope (release-please CHANGELOG edits are not typo-sweep edits; consolidation-PR closing-keyword rule doesn't apply to release-please bodies; the FIX-stage skip rule doesn't apply to the REVIEW stage). No line-level findings.