docs/chore: Phase 1 doc/code hygiene (code-review.md § Phase 1)

Removes ~30 stale "Phase N" / historical-staging comment references from
code and shell scripts now that v1.0 is done; fixes a stale dashboard
comment claiming applications/send-log were unimplemented; adds a CSRF ADR
to security.md documenting the Origin-check-over-tokens decision; resolves
docs/logo in roadmap.md (directory doesn't exist, criterion already met);
adds a gofmt -l check to CI so unformatted Go fails the build.

The known-limitations write-up for the log-tailer offset gap (the other
Phase 1 item) was already present in architecture.md § Log tailer, so no
change was needed there.

gofmt/go vet/go test clean on both Go modules (main + test/e2e), verified
on the dev server.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

cmd/panel/httpserver.go

@@ -16,8 +16,8 @@ import (
 )
 
 // serveHTTP runs the control-panel HTTP server until ctx is cancelled, using
-// the database handle shared by all roles. From Phase 2 this serves the real
-// setup, login and authenticated panel surface (spec 7.6).
+// the database handle shared by all roles: setup, login and the authenticated
+// panel surface (spec 7.6).
 func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
 	// Applications own the SASL accounts and the Postfix sender map; the domain
 	// service delegates to them when a domain (and its applications) is deleted.

cmd/panel/main.go

@@ -1,10 +1,6 @@
-// Command panel is the SelfPost control panel. In the finished product this
-// single binary combines several roles (spec 7.1): the HTTP panel server,
+// Command panel is the SelfPost control panel. This single binary combines
+// several roles (spec 7.1) as a supervised process: the HTTP panel server,
 // the journal-milter, the mail.log tailer and the rate-limit checks.
-//
-// Phase 1 wires those roles up as a supervised process with a minimal HTTP
-// stub, a journal-milter socket stub (so the Postfix start wrapper's readiness
-// probe passes) and a log-tailer stub. Real behaviour lands in later phases.
 package main
 
 import (
@@ -133,7 +129,7 @@ func loadConfig() config {
 
 // saslRealm chooses the realm new SASL accounts live under. It mirrors the
 // hostname Postfix's SASL layer uses so a client authenticating with a bare
-// login resolves to the right account (finalised in Phase 5).
+// login resolves to the right account.
 func saslRealm() string {
 	if r := os.Getenv("SASL_REALM"); r != "" {
 		return r