docs/chore: Phase 1 doc/code hygiene (code-review.md § Phase 1)

Removes ~30 stale "Phase N" / historical-staging comment references from
code and shell scripts now that v1.0 is done; fixes a stale dashboard
comment claiming applications/send-log were unimplemented; adds a CSRF ADR
to security.md documenting the Origin-check-over-tokens decision; resolves
docs/logo in roadmap.md (directory doesn't exist, criterion already met);
adds a gofmt -l check to CI so unformatted Go fails the build.

The known-limitations write-up for the log-tailer offset gap (the other
Phase 1 item) was already present in architecture.md § Log tailer, so no
change was needed there.

gofmt/go vet/go test clean on both Go modules (main + test/e2e), verified
on the dev server.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/postfix/postfix.go

@@ -1,8 +1,7 @@
 // Package postfix owns the Postfix configuration files the panel edits at
-// runtime and the privileged reload that applies them (spec 5.1, 7.6.3-4). In
-// Phase 4 that is the smtpd_sender_login_maps table binding each application's
-// SASL login to the sender addresses it may use; the full relay configuration
-// lands in Phase 5.
+// runtime and the privileged reload that applies them (spec 5.1, 7.6.3-4): the
+// smtpd_sender_login_maps table binding each application's SASL login to the
+// sender addresses it may use, plus the relay configuration in main.cf.
 package postfix
 
 import (
@@ -33,8 +32,8 @@ func New(dir string) *Postfix {
 	}
 }
 
-// SenderLoginMapsPath is the absolute path of the generated map, so the Postfix
-// main.cf written in Phase 5 can point smtpd_sender_login_maps at it.
+// SenderLoginMapsPath is the absolute path of the generated map, so main.cf
+// can point smtpd_sender_login_maps at it.
 func (p *Postfix) SenderLoginMapsPath() string {
 	return p.senderLoginMapsPath
 }