docs/chore: Phase 1 doc/code hygiene (code-review.md § Phase 1)

Removes ~30 stale "Phase N" / historical-staging comment references from
code and shell scripts now that v1.0 is done; fixes a stale dashboard
comment claiming applications/send-log were unimplemented; adds a CSRF ADR
to security.md documenting the Origin-check-over-tokens decision; resolves
docs/logo in roadmap.md (directory doesn't exist, criterion already met);
adds a gofmt -l check to CI so unformatted Go fails the build.

The known-limitations write-up for the log-tailer offset gap (the other
Phase 1 item) was already present in architecture.md § Log tailer, so no
change was needed there.

gofmt/go vet/go test clean on both Go modules (main + test/e2e), verified
on the dev server.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/milter/milter.go

@@ -37,7 +37,7 @@ type Store interface {
 
 // session accumulates the fields of one message as the milter callbacks fire.
 // Milter macros arrive per-stage and do not accumulate, so each value is
-// captured at the stage that carries it (spec 7.3 / Phase 0 spike): SASL login
+// captured at the stage that carries it (spec 7.3): SASL login
 // and From at MAIL, each recipient at RCPT, Subject in the headers, and the
 // queue-id at end-of-message. go-milter creates one session per connection; a
 // connection may carry several messages, so per-message fields are reset at
@@ -55,8 +55,8 @@ type session struct {
 }
 
 // Connect captures the client IP, which comes from the addr parameter rather
-// than a macro (the {client_addr} macro was empty in the spike). It is the
-// rate-limit key for Phase 8; here it is recorded for completeness.
+// than a macro (the {client_addr} macro was empty in testing). It is the
+// rate-limit key; here it is recorded for completeness.
 func (s *session) Connect(host, family string, port uint16, addr net.IP, m *milter.Modifier) (milter.Response, error) {
 	if addr != nil {
 		s.clientIP = addr.String()
@@ -133,8 +133,7 @@ func (s *session) Body(m *milter.Modifier) (milter.Response, error) {
 // macro reads a milter macro, tolerating Postfix's convention of wrapping
 // multi-character macro names in curly braces (e.g. {auth_authen}) while
 // single-character names (e.g. i) arrive bare. go-milter stores whatever name
-// Postfix sends verbatim, so a lookup must try both forms — this is exactly the
-// distinction the SASL-less Phase 0 spike could not observe.
+// Postfix sends verbatim, so a lookup must try both forms.
 func macro(m *milter.Modifier, name string) string {
 	if v, ok := m.Macros[name]; ok {
 		return v
@@ -180,7 +179,7 @@ func cleanAddress(a string) string {
 }
 
 // domainOf returns the lower-cased domain of an email address, or "" if there
-// is no domain part. Sender binding (Phase 4) guarantees the From domain equals
+// is no domain part. Sender binding guarantees the From domain equals
 // the application's domain, so this is the sending domain (spec 7.3).
 func domainOf(addr string) string {
 	if i := strings.LastIndexByte(addr, '@'); i >= 0 {