Upgrade to 1.0.40

Concerns: pushword/static-generator

Brotli before zstd

The generated .Caddyfile and .htaccess now prefer the brotli sidecar over the zstd one. Run pw:static to regenerate both files, then reload the web server.