docs/chore: Phase 1 doc/code hygiene (code-review.md § Phase 1)

Removes ~30 stale "Phase N" / historical-staging comment references from
code and shell scripts now that v1.0 is done; fixes a stale dashboard
comment claiming applications/send-log were unimplemented; adds a CSRF ADR
to security.md documenting the Origin-check-over-tokens decision; resolves
docs/logo in roadmap.md (directory doesn't exist, criterion already met);
adds a gofmt -l check to CI so unformatted Go fails the build.

The known-limitations write-up for the log-tailer offset gap (the other
Phase 1 item) was already present in architecture.md § Log tailer, so no
change was needed there.

gofmt/go vet/go test clean on both Go modules (main + test/e2e), verified
on the dev server.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,17 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+### Changed
+
+- Phase 1 doc/code hygiene (`docs/code-review.md`): removed ~30 stale
+  "Phase N" / historical-staging references from code and shell-script
+  comments (`cmd/panel`, `internal/*`, `build/*`) now that v1.0 is done;
+  fixed a stale dashboard comment (`internal/web/handlers_domains.go`)
+  claiming applications/send-log were unimplemented; added a CSRF ADR to
+  `docs/security.md` (why Origin-check, not tokens); resolved `docs/logo` in
+  `docs/roadmap.md` (directory doesn't exist, criterion already met); added a
+  `gofmt -l` check to CI (`.github/workflows/test.yml`).
+
 ### Security
 
 - Pre-release security review (plan § D, model Fable, 2026-08-06): full pass