docs: retire the code-review plan, its content now lives where it belongs

The review document was the last place several findings existed, so it could
not just be deleted. Everything still useful moved out first:

- roadmap items csrf-tokens, template-data-typing, structured-logging and
  review-2026-08-followups are now self-contained — each row names the file,
  the symptom and what "done" means, instead of pointing at a paragraph number
  in a plan file.
- security.md's CSRF accepted-risk bullet now names the csrf-tokens item, so
  the two records of that decision cannot drift apart unnoticed; the item says
  the same in the other direction.
- CHANGELOG [Unreleased] records the review itself in its intro rather than as
  an added file: the document was created and removed inside one unreleased
  cycle, so it never was part of a release.
- the declined finding (//go:build linux for the /proc reader) keeps its
  rationale in the roadmap so it is not raised again.

Also repaired three links to inbound-relay.md, deleted back when that feature's
plan was cleaned up: the two inbound plans now point at architecture.md § Mail
path for the as-built behaviour.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/plans/inbound-quarantine.md

@@ -43,7 +43,8 @@ attack/backup surface — closer to "mini-mailbox" than pure relay.
 
 ## Context (as-built)
 
-- Inbound relay forwards or rejects; no local delivery ([inbound-relay.md](inbound-relay.md)).
+- Inbound relay forwards or rejects; no local delivery
+  ([architecture.md](../architecture.md) § Mail path).
 - Optional `INBOUND_ANTISPAM_MILTER` — external rspamd may quarantine on its
   own today, without panel integration.
 - DMARC `p=quarantine` is unrelated (outbound policy for receivers).
@@ -56,7 +57,8 @@ attack/backup surface — closer to "mini-mailbox" than pure relay.
 
 ## Dependencies
 
-- [inbound-relay.md](inbound-relay.md) (shipped).
+- Inbound relay, shipped in `[1.4.0]` — as built in
+  [architecture.md](../architecture.md) § Mail path.
 - Sensible to decide **after** or **alongside**
   [inbound-antispam-panel.md](inbound-antispam-panel.md) (journal/lists), but
   not blocked on it for design discussion.