docs/chore: Phase 1 doc/code hygiene (code-review.md § Phase 1)

Removes ~30 stale "Phase N" / historical-staging comment references from
code and shell scripts now that v1.0 is done; fixes a stale dashboard
comment claiming applications/send-log were unimplemented; adds a CSRF ADR
to security.md documenting the Origin-check-over-tokens decision; resolves
docs/logo in roadmap.md (directory doesn't exist, criterion already met);
adds a gofmt -l check to CI so unformatted Go fails the build.

The known-limitations write-up for the log-tailer offset gap (the other
Phase 1 item) was already present in architecture.md § Log tailer, so no
change was needed there.

gofmt/go vet/go test clean on both Go modules (main + test/e2e), verified
on the dev server.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/web/handlers_auth.go

@@ -13,7 +13,7 @@ import (
 // TLS in front, so CookieSecure — it carries the __Host- prefix, which turns
 // what the cookie's attributes merely promise into something the browser
 // enforces: Secure, Path=/ and, the point of the exercise, no Domain
-// attribute, so no other host may set a cookie by this name (phase 14.B).
+// attribute, so no other host may set a cookie by this name.
 // The prefix is only valid on a Secure cookie, so a development instance on
 // plain HTTP has to keep the bare name: with the prefix the browser would
 // discard the Set-Cookie outright and logging in would silently never stick.
@@ -42,7 +42,7 @@ func (s *Server) sessionCookie() string {
 // is denial of service, not compromise; refusing the request and saying so in
 // the log is what makes it diagnosable instead of an endless login loop. The
 // __Host- prefix prevents this outright, but only where it applies — this
-// check also covers the plain-HTTP development shape (phase 14.B).
+// check also covers the plain-HTTP development shape.
 func (s *Server) sessionToken(r *http.Request) (string, bool) {
 	name := s.sessionCookie()
 	var token string