docs: drop completed work from the plan and progress tracker

The plan is meant to hold only what is still open, but three of its numbered
items had already been implemented and were still being read as pending work:
the TRUSTED_PROXY_CIDR-gated X-Forwarded-For handling (A.1), the account
settings page (A.6) and the go vet/go test CI workflow (C.10). Remove them
and renumber; the residual scope note from A.6 (2FA, multiple admins) moves
to section D, which is where deliberately deferred scope belongs.

Same for the "done" notices at the top of the plan and the phase-by-phase
retellings in progress.md: phases 12 and 13 are described in full in the
CHANGELOG and git history, so the tracker now states what is closed and what
is next, and nothing else.

Three code comments cited plan item numbers that this renumbering would have
silently pointed at a different item, and one cited a phase 13 section that
no longer exists; they now state the fact instead of the reference. The CI
test workflow was never recorded in the CHANGELOG, so its entry is added
there before the plan item describing it goes away.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/web/web.go

@@ -45,7 +45,7 @@ type Config struct {
 	DBPath  string
 	Version string
 	// TrustedProxyCIDRs are the reverse-proxy addresses allowed to supply
-	// X-Forwarded-For (plan.md item A.1: TRUSTED_PROXY_CIDR). A request whose
+	// X-Forwarded-For (env TRUSTED_PROXY_CIDR). A request whose
 	// direct peer (RemoteAddr) is not in this list never has its XFF header
 	// honoured, so the header can't be spoofed by anyone but a trusted proxy.
 	// Empty (the default) keeps rate-limiting keyed on RemoteAddr only.
@@ -200,7 +200,7 @@ func handleHealth(w http.ResponseWriter, _ *http.Request) {
 // transport peer (RemoteAddr), which cannot be spoofed. If RemoteAddr matches
 // one of trustedProxies, the last entry of X-Forwarded-For is used instead —
 // that is the address the trusted proxy itself appended, so a client can't
-// forge it by sending its own XFF header (plan.md item A.1). With no trusted
+// forge it by sending its own XFF header. With no trusted
 // proxies configured, behind a reverse proxy this is the proxy's own address,
 // which is an acceptable backstop for a single-admin panel.
 func clientIP(r *http.Request, trustedProxies []*net.IPNet) string {