docs: condense comments across the repo

Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21

hosts/jupiter/secrets.nix

@@ -1,14 +1,8 @@
 { config, ... }:
 
-# sops-nix secret wiring (real host only; not imported by vm.nix).
-# Encrypted values live in ../../secrets/jupiter.yaml, decrypted at activation to
-# /run/secrets/<name>.
-#
-# The host decrypts with its OWN SSH host key (age identity derived via
-# ssh-to-age, recipient listed in ../../.sops.yaml). The key is pre-generated on
-# the laptop and shipped once at install as /etc/ssh/ssh_host_ed25519_key
-# (nixos-anywhere --extra-files) — so decryption works on boot #1 and there is
-# no separate sops-only key to manage.
+# sops-nix secret wiring (real host only; not imported by vm.nix). Decrypts with the
+# host's own SSH host key (ssh-to-age), shipped once at install via nixos-anywhere
+# --extra-files, so there's no separate sops-only key to manage.
 {
   sops.defaultSopsFile = ../../secrets/jupiter.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
@@ -26,18 +20,14 @@
   # Headscale pre-auth key for tailscale auto-registration (see configuration.nix).
   sops.secrets.tailscale_authkey = { };
 
-  # Immich's OIDC client secret, from its Authentik application (a SEPARATE
-  # app from headscale's and headplane's — see hosts/neptun/secrets.nix).
-  # Referenced as settings.oauth.clientSecret._secret in
-  # services/media/immich.nix; the module resolves it through systemd
-  # LoadCredential, which reads as root before dropping privileges, so the
-  # sops default of root:root 0400 is correct — do NOT set `owner`.
+  # Immich's OIDC client secret (separate Authentik app from headscale/headplane, see
+  # hosts/neptun/secrets.nix). Resolved via systemd LoadCredential as root before
+  # privilege drop, so sops's default root:root 0400 is correct — do NOT set `owner`.
   sops.secrets.immich_oauth_client_secret = { };
 
-  # Gitea Actions runner registration token (services/dev/gitea.nix). Gitea
-  # generates this itself once Actions is enabled — it is not a password
-  # chosen up front. Rendered into a `TOKEN=...` env file because
-  # gitea-actions-runner takes an EnvironmentFile, not a raw secret path.
+  # Gitea Actions runner registration token — gitea generates this itself once Actions
+  # is enabled. Rendered into an env file since gitea-actions-runner takes an
+  # EnvironmentFile, not a raw secret path.
   sops.secrets.gitea_runner_token = { };
   sops.templates."gitea-runner.env".content =
     "TOKEN=${config.sops.placeholder.gitea_runner_token}";
@@ -53,15 +43,11 @@
     owner = "gitea";
   };
 
-  # SABnzbd credentials (web UI login, API keys, eweka.nl usenet server) —
-  # migrated off the reused ini in services/media/sabnzbd.nix into
-  # services.sabnzbd.settings + secretValues. sabnzbd_api_key predates this
-  # migration (provisioned for mediamanager's future use, services/experimental/
-  # mediamanager.nix — not currently imported by any host); reused here as the
-  # same single source of truth rather than duplicating it.
-  # owner = sabnzbd: the module's preStart (replace-secret) runs as the
-  # service's own User=/Group=, and sops secrets default to root:root 0400 —
-  # without this, replace-secret gets Permission denied reading /run/secrets.
+  # SABnzbd credentials (web UI login, API keys, eweka.nl usenet server) for
+  # services/media/sabnzbd.nix; sabnzbd_api_key is shared with
+  # services/experimental/mediamanager.nix rather than duplicated.
+  # owner = sabnzbd because the module's preStart runs as that user, and sops secrets
+  # default to root:root 0400.
   sops.secrets.sabnzbd_web_username.owner = "sabnzbd";
   sops.secrets.sabnzbd_web_password.owner = "sabnzbd";
   sops.secrets.sabnzbd_api_key.owner = "sabnzbd";
@@ -69,15 +55,12 @@
   sops.secrets.sabnzbd_eweka_username.owner = "sabnzbd";
   sops.secrets.sabnzbd_eweka_password.owner = "sabnzbd";
 
-  # CouchDB admin account for Obsidian LiveSync
-  # (services/dev/obsidian-livesync.nix). Rendered into an [admins] ini
-  # fragment rather than passed as services.couchdb.adminPass, which would put
-  # the plaintext in the world-readable store.
-  #
-  # owner = couchdb on BOTH: couchdb re-reads its ini chain as its own
-  # User=/Group= after systemd drops privileges, and sops defaults to
-  # root:root 0400 — without this it comes up with no admin configured, which
-  # under require_valid_user means every request 401s.
+  # CouchDB admin account for Obsidian LiveSync — rendered into an [admins] ini
+  # fragment instead of services.couchdb.adminPass, which would put the plaintext in
+  # the world-readable store.
+  # owner = couchdb on both: couchdb re-reads the ini as its own user after privilege
+  # drop, and without this sops's default root:root 0400 leaves it with no admin
+  # configured (every request 401s).
   sops.secrets.couchdb_admin_password.owner = "couchdb";
   sops.templates."couchdb-admins.ini" = {
     owner = "couchdb";