docs: drop completed work from the plan and progress tracker

The plan is meant to hold only what is still open, but three of its numbered
items had already been implemented and were still being read as pending work:
the TRUSTED_PROXY_CIDR-gated X-Forwarded-For handling (A.1), the account
settings page (A.6) and the go vet/go test CI workflow (C.10). Remove them
and renumber; the residual scope note from A.6 (2FA, multiple admins) moves
to section D, which is where deliberately deferred scope belongs.

Same for the "done" notices at the top of the plan and the phase-by-phase
retellings in progress.md: phases 12 and 13 are described in full in the
CHANGELOG and git history, so the tracker now states what is closed and what
is next, and nothing else.

Three code comments cited plan item numbers that this renumbering would have
silently pointed at a different item, and one cited a phase 13 section that
no longer exists; they now state the fact instead of the reference. The CI
test workflow was never recorded in the CHANGELOG, so its entry is added
there before the plan item describing it goes away.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cmd/panel/main.go

@@ -99,7 +99,7 @@ func loadConfig() config {
 		// matches postfix-config.sh, which enables the listener on "true" alone.
 		submissionEnabled: os.Getenv("SUBMISSION_ENABLE") == "true",
 		// Reverse-proxy addresses allowed to supply X-Forwarded-For for
-		// rate-limiting (plan.md item A.1). Empty by default: an untrusted peer's
+		// rate-limiting. Empty by default: an untrusted peer's
 		// XFF header is trivially forgeable, so it's ignored unless the panel is
 		// told which proxy to trust.
 		trustedProxies: parseTrustedProxies(os.Getenv("TRUSTED_PROXY_CIDR")),