fix: Cross-origin postMessage and loosen dep constraints

- Fix OAuth callback postMessage to fall back to '*' targetOrigin for cross-origin popups
- Remove dead-end error path that blocked communication between different-origin opener windows
- Add regression test for cross-origin postMessage fallback in callback HTML
- Loosen postgrex (~> 0.19), phoenix (~> 1.7), telemetry (~> 1.0) for wider compatibility
- Bump version to 0.1.1
- Update README install instruction to ~> 0.1.1

v0.1.0 - Initial release of Tango