Trim comments across configs and services

Shorten verbose multi-paragraph comments to essentials, and drop a
stale claim in common.nix that jupiter kept its own copy of the base
config (it now imports common.nix directly).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/neptun/configuration.nix

@@ -60,14 +60,11 @@
   '';
 
   # ---- Headscale + Headplane (tailnet control server + its web UI) ----
-  # Both run locally on neptun (see services/{headscale,headplane}.nix), path
-  # -routed on the same vhost: Headplane owns /admin* (its whole app,
-  # including static assets and the OIDC callback, lives under that prefix —
-  # `handle` keeps the prefix in the forwarded path, unlike `handle_path`,
-  # since Headplane needs to see it), everything else goes to headscale
-  # itself (tailnet client traffic). headscale's node-update endpoint is a
-  # long-poll, hence `flush_interval -1` — without it Caddy buffers the
-  # response and clients see stale state.
+  # Path-routed on one vhost: Headplane owns /admin* (uses `handle`, not
+  # `handle_path`, since it needs the prefix kept in the forwarded path for
+  # its own assets + OIDC callback); everything else goes to headscale.
+  # `flush_interval -1`: headscale's node-update endpoint is a long-poll and
+  # Caddy would otherwise buffer it, showing clients stale state.
   services.caddy.virtualHosts."vpn.mgaction.town".extraConfig = ''
     handle /admin* {
       reverse_proxy http://localhost:3000
@@ -80,12 +77,10 @@
   '';
 
   # ---- Gitea SSH forward ----
-  # Caddy only proxies HTTP; git-over-ssh needs a raw TCP forward. Gitea's
-  # own built-in SSH server runs on jupiter:2222 (see services/gitea.nix —
-  # not :222, the unpriv gitea user can't bind <1024). Forward this VPS's
-  # public :2222 to it over the tailnet, so `ssh://git@git.mgaction.town:2222/...`
-  # reaches gitea. Needs a matching inbound-2222 rule in netcup's *edge*
-  # firewall panel too (separate from this box's own, and not managed by Nix).
+  # Caddy only proxies HTTP; forward :2222 over the tailnet to gitea's own
+  # SSH server on jupiter (services/gitea.nix), so
+  # `ssh://git@git.mgaction.town:2222/...` works. Also needs a matching
+  # inbound-2222 rule in netcup's edge firewall panel (not managed by Nix).
   systemd.services.gitea-ssh-forward = {
     description = "Forward :2222 to jupiter's gitea SSH server over tailscale";
     after = [ "network-online.target" "tailscaled.service" ];