docs: track every unimplemented review finding in the roadmap

Nothing from the 2026-08-19 code review now lives only in its plan file. Four
new roadmap items, all `candidate`:

- csrf-tokens — §4.4. The review recorded a decision to add per-session tokens
  but never turned it into a task, and security.md still argues the header
  checks suffice. The item says to settle which of the two stands first.
- template-data-typing — §7.1, map[string]any template payloads.
- structured-logging — §7.2 and §5.5, log/slog plus the per-package logf
  aliases.
- review-2026-08-followups — the small remainder: backup re-auth, the missing
  DMARC-service / handler / error-page / corrupted-backup tests, and the nine
  minor findings (§6.1, §6.2, §6.4, §7.4, §8.6, §9.3, §10.3-10.5) that were
  never carried into the phase tables.

§7.3 (build tags for the /proc reader) is deliberately not carried over: it was
declined during the pass, and both documents now say so, so it does not get
re-raised at the next review.

The plan's status table links each open row to its roadmap item, and the
roadmap's recommended-order note points back at the plan. Also unlinked two
CHANGELOG references to plan files deleted after those releases shipped; the
text stays, the dead links do not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -103,6 +103,14 @@ rate limit is correct for a non-default level-1 window. Schema migration
 
 ### Changed
 
+- [roadmap.md](docs/roadmap.md) now carries everything the 2026-08-19 code
+  review left unimplemented, so no finding lives only in a plan file:
+  `csrf-tokens` (the recorded §4.4 decision that never became a task),
+  `template-data-typing`, `structured-logging`, and
+  `review-2026-08-followups` for the small remainder (backup re-auth, the
+  missing service/handler/error-page tests, and nine minor findings that were
+  never in the phase tables). The review plan's status table links each row to
+  its roadmap item; the one declined finding is marked as declined in both.
 - Extracted `internal/configsafe` — the empty-value and forbidden-character
   check every generated config file shares. Each writer keeps its own forbidden
   set next to the file it protects (an OpenDKIM table and a Postfix map break on
@@ -414,7 +422,7 @@ Plex. Upgrading from 1.2.x is a tag bump; no migration.
 - docs: agreed roadmap item **queue-retries** — show this Postfix's retry
   policy (first delay, backoff cap, queue lifetime) on Mail queue and on a
   delivery's history, reading `postconf -h` once at panel start so a manual
-  override is visible. Plan: [docs/plans/queue-retries.md](docs/plans/queue-retries.md).
+  override is visible. Plan: `docs/plans/queue-retries.md` (removed once shipped).
   Explanation only; no attempt counter and no panel knobs. Not yet
   implemented.
 
@@ -606,7 +614,7 @@ Plex. Upgrading from 1.2.x is a tag bump; no migration.
   RBAC in the doc-alignment pass above). Corrected stale
   `admin.dmarc_report_email` references in
   [roadmap.md](docs/roadmap.md) and
-  [docs/plans/dmarc-reports.md](docs/plans/dmarc-reports.md) to the setting's
+  `docs/plans/dmarc-reports.md` (removed once shipped) to the setting's
   actual home after migration `0005`. No behaviour change.
 
 - panel: code-review P6 cleanup — the unused `auth.RequireGlobal` middleware is