docs: drop completed work from the plan and progress tracker

The plan is meant to hold only what is still open, but three of its numbered
items had already been implemented and were still being read as pending work:
the TRUSTED_PROXY_CIDR-gated X-Forwarded-For handling (A.1), the account
settings page (A.6) and the go vet/go test CI workflow (C.10). Remove them
and renumber; the residual scope note from A.6 (2FA, multiple admins) moves
to section D, which is where deliberately deferred scope belongs.

Same for the "done" notices at the top of the plan and the phase-by-phase
retellings in progress.md: phases 12 and 13 are described in full in the
CHANGELOG and git history, so the tracker now states what is closed and what
is next, and nothing else.

Three code comments cited plan item numbers that this renumbering would have
silently pointed at a different item, and one cited a phase 13 section that
no longer exists; they now state the fact instead of the reference. The CI
test workflow was never recorded in the CHANGELOG, so its entry is added
there before the plan item describing it goes away.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/dnscheck/spf.go

@@ -17,8 +17,8 @@ const spfLookupBudget = 10
 
 // checkSPF reports whether the domain's SPF record authorises this server.
 //
-// This is deliberately a shallow check (see docs/implementation-plan.md, phase
-// 13.B.2): it looks for a mechanism that literally covers the server's address —
+// This is deliberately a shallow check (documented as such in the README): it
+// looks for a mechanism that literally covers the server's address —
 // ip4:/ip6:, or a/mx resolving to it — and does not recurse into include: or
 // redirect=, nor evaluate the record the way a receiver would. That is why a
 // record which does not obviously cover us but does use include: is reported as