docs/chore: Phase 1 doc/code hygiene (code-review.md § Phase 1)

Removes ~30 stale "Phase N" / historical-staging comment references from
code and shell scripts now that v1.0 is done; fixes a stale dashboard
comment claiming applications/send-log were unimplemented; adds a CSRF ADR
to security.md documenting the Origin-check-over-tokens decision; resolves
docs/logo in roadmap.md (directory doesn't exist, criterion already met);
adds a gofmt -l check to CI so unformatted Go fails the build.

The known-limitations write-up for the log-tailer offset gap (the other
Phase 1 item) was already present in architecture.md § Log tailer, so no
change was needed there.

gofmt/go vet/go test clean on both Go modules (main + test/e2e), verified
on the dev server.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/web/handlers_apps.go

@@ -97,8 +97,8 @@ func (s *Server) renderDomainDetail(w http.ResponseWriter, r *http.Request, stat
 	}
 
 	// What DNS actually publishes for the domain today, checked against the key
-	// this server signs with (phase 13.B). Cached by the checker, so
-	// re-rendering the page after a form post costs nothing.
+	// this server signs with. Cached by the checker, so re-rendering the page
+	// after a form post costs nothing.
 	dns, srv := s.domainDNS(d, record, false)
 
 	s.render(w, status, "domain_detail", map[string]any{
@@ -139,7 +139,7 @@ func (s *Server) renderDomainDetail(w http.ResponseWriter, r *http.Request, stat
 }
 
 // domainDNS resolves what the world sees for a domain: its DKIM, SPF and DMARC
-// records (phase 13.B). The server's own address comes from the (separately
+// records. The server's own address comes from the (separately
 // cached) hostname check, so the SPF heuristic knows which IP it is looking for
 // and no extra environment variable is needed. That server result is returned
 // alongside, because the page's suggested SPF record is built from the same