chore(release): v0.2.0a4 + fix(build): sync pnpm-lock.yaml (#230)

* chore(release): bump to v0.2.0a4 — sixth PyPI alpha

Ships the parity batch merged since 0.2.0a3:
- Inline editing in the SPA (#223) + inline field-type metadata (#220).
- PWA end-to-end: SW registration + manifest link + install affordance
  (#219, #222) on top of the backend serving (#200).
- Navigable ForeignKey links in list + detail (#215, #217) — `to`
  emitted only for registered models (anti-adjacency-leak, #89 posture).
- List column customizer (#214), portal Modal (#221), threat-model
  refresh (#216).

Security review of the batch (issue #225): code is secure + documented;
one low-risk incomplete control (cache-purge-on-logout not yet wired
frontend-side — moot under the no-store read posture) is tracked.
CodeQL 0, Dependabot 0, 374 tests pass. Tier 6.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(build): sync pnpm-lock.yaml with apps/web package.json (react-dom/@types/react-dom)

A recent PR (#221/#222) added `react-dom` + `@types/react-dom` to
`frontend/apps/web/package.json` but didn't regenerate the lockfile,
so `pnpm install --frozen-lockfile` (the build + CI path) fails on
`main`:

    specifiers in the lockfile (...) don't match specs in package.json

Regenerated with `pnpm install --lockfile-only` (no version changes —
only adds the already-declared specifiers to the lock). Frozen install
now passes. Release-blocking build-integrity fix found while cutting
0.2.0a4.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Martin Castro Laminrs <mcastro@laminr.ai>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 3 people

frontend/pnpm-lock.yaml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-admin-react"
-version = "0.2.0a3"
+version = "0.2.0a4"
 description = "A drop-in React single-page admin for Django, driven entirely by ModelAdmin."
 authors = ["django-admin-react contributors"]
 license = "MIT"